Relume FMEA

FMEA OF OSV "RELUME"
FOR MENAS
MAY 2013 24025-0912-16117 | REVISION 9
Table of Contents
1. 2.
2.1 2.2 2.3
SUMMARY ............................................................. 1 INTRODUCTION .................................................... 2

INSTRUCTIONS ........................................................................... 2 VESSEL PARTICULARS .............................................................. 3 DEFINITION OF DP CLASS 2 ....................................................... 4
Document Details
Report Title FMEA of OSV "RELUME"
Author AS/AFF GM Doc. No. 24025-0912-16117 | Revision 9 File Name GM 24025-0912-16117 FMEA OF OSV RELUME REV 8 Issue Record Date 08.10.04 21.10.04 29.10.04 05.04.05 20.03.06 11.10.12 3.01.13 28.01.13 30.05.13 Rev 1 2 3 4 5 6 7 8 9 Checked CAJ NPC NPC JFD AJC AS AS AFF AFF Approved JFD JFD JFD CAJ CAJ JFD JFD AS AS
3. 4.
4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9
REDUNDANCY CONCEPT OVERVIEW ................ 6 POWER GENERATION ......................................... 8

FUEL OIL SYSTEM....................................................................... 8 FO SYSTEM FAILURE MODES .................................................... 9 SEA WATER COOLING .............................................................. 12 SW COOLING SYSTEM FAILURE MODES................................. 13 FRESH WATER COOLING SYSTEM ......................................... 13 FW COOLING SYSTEM FAILURE MODES ................................. 15 L.O. SYSTEM .............................................................................. 16 LO COOLING SYSTEM FAILURE MODES ................................. 17 COMPRESSED AIR .................................................................... 17 COMPRESSED AIR SYSTEM FAILURE MODES........................ 19 VENTILATION ............................................................................. 19 VENTILATION FAILURE MODES ................................................ 20 DIESEL GENERATOR ENGINES ............................................... 20 DIESEL GENERATOR ENGINES FAILURE MODES .................. 21 POWER MANAGEMENT SYSTEM ............................................ 22 POWER BALANCE ..................................................................... 31 ENGINE ROOM FIRE ................................................................. 31 690V MAIN SWITCHBOARD ...................................................... 32 690V MAIN SWITCHBOARD FAILURE MODES ......................... 34 440V SWITCHBOARD................................................................. 34 440V DISTRIBUTION FAILURE MODES ..................................... 35 440V EMERGENCY SWITCHBOARD ......................................... 36 440V EMERGENCY SWITCHBOARD FAILURE MODES............ 37 230V SWITCHBOARDS.............................................................. 38 230V DISTRIBUTION FAILURE MODES ..................................... 40 230V EMERGENCY SWITCHBOARD ......................................... 40 230V EMERGENCY SWITCHBOARD FAILURE MODES............ 41 24V SYSTEMS ............................................................................ 41
Notes
4.10 4.11 4.12 4.13 4.14 4.15 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28
This document is the property of Global Maritime Scotland Ltd and is not to be copied, nor shown, to third parties without prior consent
.
Global Maritime Scotland Ltd Johnstone House 50-54 Rose Street AB10 1UD Aberdeen Scotland T +44 (0) 1224 625600 F +44 (0) 1224 624447
www.globalmaritime.com
Registered in London No. 2912969
4.29 4.30 4.31
24VDC SYSTEMS FAILURE MODES .......................................... 43 DP UPS ....................................................................................... 44 DP UPS FAILURE MODES .......................................................... 44
5.
5.1 5.2 5.3 5.4 5.5 5.6
THRUSTERS ....................................................... 45
DP CAPABILITY.......................................................................... 45 BOW THRUSTERS ..................................................................... 45 BOW THRUSTERS FAILURE MODES ....................................... 45 AZIMUTH THRUSTERS.............................................................. 47 AZIMUTH THRUSTERS FAILURE MODES ................................. 47 THRUSTERS EMERGENCY STOPS .......................................... 48
6.
6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9
DP CONTROL SYSTEMS .................................... 49

DP21 COMPUTERS ................................................................... 49 OPERATOR CONSOLES ........................................................... 50 DP CONTROL MODES FUNCTIONS ......................................... 51 IJS SYSTEM ................................................................................ 52 MOTION SENSORS.................................................................... 52 MRU FAILURE MODES .............................................................. 52 GYRO COMPASSES .................................................................. 53 GYROS FAILURE MODES .......................................................... 53 WIND SENSORS ........................................................................ 53 WIND SENSORS FAILURE MODES ........................................... 54 HYDRO ACOUSTIC POSITION REFERENCE (HPR)................ 54 HPR FAILURE MODES ............................................................... 55 DGPS .......................................................................................... 55 DGPS FAILURE MODES ............................................................ 56 FAN BEAM .................................................................................. 56 FAILURE MODES OF THE FANBEAM ........................................ 58 TAUT WIRE................................................................................. 59 TAUT WIRE FAILURE MODES ................................................... 60 POSITION REFERENCES A N D WEIGHTING .......................... 60
6.10 6.11 6.12 6.13 6.14 6.15 6.16 6.17 6.18 6.19
7.
7.1 7.2
COMMUNICATIONS ........................................... 61
BRIDGE....................................................................................... 61 DP ALERT SYSTEM .................................................................... 61
8.
8.1
CONCLUSIONS ................................................... 62
GENERAL ................................................................................... 62
9.
RECOMMENDATIONS ........................................ 63
9.1 9.2 9.3
A RECOMMENDATIONS ESSENTIAL ................................... 63 B RECOMMENDATIONS FOR SERIOUS CONSIDERATION ... 63 C RECOMMENDATIONS- FOR FUTURE CONSIDERATION / GENERAL IMPROVEMENT ........................................................ 63
10.
TABULATED FAILURE MODES ......................... 30
Figures & Tables

FIGURE 2-1: OSV RELUME PROFILE ............................................................. 3 FIGURE 4-1: FUEL OIL SYSTEM (REF DRAWING NO 320.01)....................... 8 TABLE 4-1: FO SYSTEM FAILURE MODES .................................................. 10 FIGURE 4-2: SW COOLING SYSTEM (REF DRAWING 330.01).................... 12 TABLE 4-2: SW SYSTEM FAILURE MODES ................................................. 13 FIGURE 4-3: FRESH WATER COOLING SYSTEM........................................ 14 TABLE 4-3: FW COOLING SYSTEM FAILURE MODES ................................ 15 FIGURE 4-4: ENGINE LO SYSTEM SCHEMATICS ....................................... 16 FIGURE 4-5: COMPRESSED AIR SYSTEM LAYOUT.................................... 18 TABLE 4-4: MAIN ENGINE WECS POWER SUPPLIES ................................. 21 TABLE 4-5: MAIN ENGINES FAILURE MODES ............................................. 22 TABLE 4-6: ALARM & CONTROL SYSTEM I/O UNITS .................................. 23 TABLE 4-7: ALARM & CONTROL SYSTEM NETWORK CONFIGURATION.. 24 TABLE 4-8: ALARM & CONTROL SYSTEM FAILURE MODES ..................... 25 FIGURE 4-6: PMS LAYOUT ........................................................................... 30 FIGURE 4-7: ELECTRICAL DISTRIBUTION SYSTEM (REF DRAWING 300144-400_000-GRS-001 SINGLE LINE) ............................................ 32 TABLE 4-9: 440V MSB CONSUMERS ........................................................... 35 TABLE 4-10: 440V ESB CONSUMERS .......................................................... 37 TABLE 4-11: 230V MSB CONSUMERS ......................................................... 38 TABLE 4-12: ENSB PS AND SB CONSUMERS ............................................ 39 TABLE 4-13: 230V NSB CONSUMERS ......................................................... 39 TABLE 4-14: 230V EMERGENCY SWITCHBOARD CONSUMERS ............... 41 TABLE 4-15: 230V ESB FAILURE MODES .................................................... 41 TABLE 4-16: 24VDC DISTRIBUTION POWER SUPPLIES AND DISTRIBUTION PANELS ....................................................................... 42 TABLE 4-17: 24V DC CONSUMERS ............................................................. 43 TABLE 4-18: DP UPS CONSUMERS ............................................................. 44 TABLE 5-1: TUNNEL THRUSTER FAILURE MODES .................................... 46
TABLE 5-2: AZIMUTH THRUSTER FAILURE MODES................................... 48 FIGURE 6-1: FANBEAM SCAN SPEED ........................................................ 57 FIGURE 6-2 - FANBEAM CONFIGURATION ................................................. 57
1.
SUMMARY
In 2004, Global Maritime completed an FMEA of the systems directly and indirectly involved with keeping the vessel on a wanted position or track. The work was carried out from the study of drawings, specifications and meetings at Imtech with Owners and representatives from vendors, Damen Shipyard and Three Quays, the designers. The report was then updated after the annual trials to correct a few errors and add a third DGPS. In September 2012, Global Maritime Scotland Ltd was requested to revise and update the FMEA to incorporate any changes since last revision in 2006. In November 2012, the FMEA was again revised and updated to include the new Fanbeam unit installed at the request of the charterers. The vessel specification is DP class 2 (Lloyds D P AA notation) so that the vessel can carry out offshore work where DP redundancy is required. The DP activities envisaged are ROV and dive support work, where the necessary equipment is provided by a contractor as a complete package on the after deck. The assumptions made during the study were verified during commissioning and DP Trials held in August and September 2004 and the annual trials carried out between 2006 to 2012. The vessel will be operated with the main switchboard breaker open (split configuration) and at least one diesel generator connected to each switchboard with the other generators in stand-by (depending on the load). The design worst case failure intent (DWCFI) is the loss of two diesel generators caused by contamination of one FO service tank or short circuit in a main switchboard section. The effect of this is the loss of two of the four thrusters. The FMEA is a living document and, as such, is discussed and reviewed during each annual trial by the Master and ships staff, the DP auditor, Kongsberg Maritime, Rolls Royce and any other attending third parties such as the Class Surveyor. Based on compliance with IMCA and IMO guidelines, the vessel meets the requirements for a Class 2 Dynamically Positioned vessel with the main switchboard bus tie open and is fit for carrying out DP operations within her design and operational limitations.
SUMMARY FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 1
2.
INTRODUCTION
2.1
2.1.1
Instructions
Global Maritime was instructed by MENAS to carry out a full revision of the FMEA. The original report covered all the systems involved directly or indirectly with DP and DP operations a n d was completed in 2004. The report was updated after the first annual trials in February 2006. This revision was completed in October 2012. This report was originally produced based on drawings and specifications provided during the vessel construction, it was issued as the final report, verified by the commissioning and DP trials held in August and September 2004 and updated in March 2006 and again in October 2012. This report identifies all reasonably likely failure modes and their effects. As more information becomes available, it will be incorporated in the next revision of this report so that it serves as a source of information and DP philosophy for key DP personnel working on the vessel.
2.1.2
INTRODUCTION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 2
2.2
Vessel Particulars
Figure 2-1: OSV Relume Profile
2.2.1
The following are the general particulars of the vessel: The hull, machinery and electrical installations were built and installed under special survey in accordance with the Rules and Regulations of Lloyds Register of Shipping for notation: +100A1, +LMC, UMS, DP (AA), IBS - LIGHT TENDER/ OCCASIONAL OIL RECOVERY DUTIES The Vessel is registered in the Bahamas, port of registry Nassau and is designed to comply with the requirements of the U.K. Maritime & Coastguard Agency (MCA), the Flag Authority, for a Class VII vessel.
| 3
Length Overall Length Load Water Line Length between Perpendiculars Breadth Moulded Depth Moulded to Main Deck Depth Moulded to Lower Deck Depth Moulded to Forecastle Deck Design Draft Moulded Draft Scantling Moulded
82.6 metres 78.2 metres 73.6 metres 16.5 metres 6.8 metres 4.0 metres 12.4 metres 4.0 metres 4.5 metres
2.3
2.3.1
Definition of DP Class 2
The following documents have been use as a reference in the construction of this report: IMO MSC 645 Guidelines for vessels with dynamic positioning IMCA M04/04 Methods of establishing the Safety and Reliability of Dynamic Positioning Systems IMCA M178 FMEA Management Guide IMCA M166 Guidance on Failure Modes and Effects Analysis IMCA M103 The Design and Operation of DP Vessels IMCA M04/04 - Annex Methods of Establishing the Safety & Reliability of DP Systems IMCA M154 Power Management System Study LR Class notation DP(AA) Rules
2.3.2
The basic requirements for LR Class notation DP (AA) are as follows: All systems necessary for the correct functioning of the DP system are to be configured such that a fault in any active component or system will not result in a loss of position. Passive components such as cables and pipes are to be located and protected such that the risk of fire or mechanical damage is minimized. No single fault in the generation and distribution systems is to result in the loss of more than 50 per cent of the generating capacity. Two independent automatic control systems are to be provided and arranged such that no single fault will cause loss of both systems, a fault in one causing automatic bumpless transfer to the backup system. At least three position reference systems incorporating at least two different measurement techniques are to be provided and are to be arranged so that a failure in one system will not render the other systems inoperative. At least three gyrocompasses and two vertical reference units, if necessary, are to be provided.
2.3.3
I.M.O 645 Section 3.2.3:
| 4
For equipment class 2, the power system should be divisible into two or more systems such that in the event of a failure of one system at least one other system will remain in operation. The power system may be run as one system during operation, but should be arranged by bus-tie breakers to separate automatically upon failures which could be transferred from one system to another, including overloading and short-circuits. 2.3.4 I.M.O 645 Section 3.2.3: For equipment class 2, a loss of position is not to occur in the event of a single fault in any active component or system. A single failure criterion includes any active component or system (generators, thrusters, switchboards, remote controlled valve etc.)
| 5
3.
3.1.1
REDUNDANCY CONCEPT OVERVIEW

The power system consists of four diesel generator sets, two 1000kW and two 1300kW, and one main 690V 60Hz switchboard split by a single bus-tie breaker. The main switchboard will be operated in split mode for DP2 operations. The 440V switchboards, 230V switchboards and emergency switchboards are to be operated in split mode, powered from their respective sides port and starboard for DP2 operations. The thrusters are powered from each switchboard so that the port azimuth thruster and the forward bow thruster are powered from the port main switchboard section and the starboard azimuth thruster and the aft bow thruster are powered from the starboard main switchboard section. This arrangement provides the best all round DP capability after the loss of one switchboard section and hence two thrusters. For this power generation system operating in DP Class 2 the design worst-case failures is not to exceed: Two diesel engines One high voltage switchboard section Two thrusters
3.1.2
3.1.3
3.1.4
3.1.5
The FO system consists of two independent systems (port and starboard) with each system supplying fuel to two diesel generator engines. There are crossover lines fitted with isolation valves. These valves should be kept closed for DP2 operations so the two FO systems are independent from each other. The SW system is a common system in terms of piping. However failure of pipes is not considered for DP2 vessels. Two SW pumps are installed so failure of one pump will cause the standby pump to autostart. The FW system is also a common system in term of the pipe arrangement. However failure of pipes is not considered for DP2 vessels. Two FW pumps are installed so failure of one pump will cause the standby pump to autostart. The starting air system is also common with redundant active components and compressors. There are two receivers. For loss of starting air to be critical there has to be two failures namely, a loss of one or more diesel engines and a loss of starting air so that they cannot be restarted or another brought on line. The vessel is fitted with an Alarm, Monitoring and Control System. This system covers the requirements for an unmanned engine room, the remote monitoring starting and stopping of equipment, the audible and visual alarms and the power management. The whole system is integrated with data being transmitted over a redundant Ethernet network with two independent LAN connections. The operation of this redundant network is such that either the Main or Backup network can take control in case of any one failing. Each diesel engine has an individual PMS module (PS 3500), which is linked by a dual redundant CAN-bus so that the loss of one link will cause an alarm but no loss of power management function.
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
REDUNDANCY CONCEPT OVERVIEW FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 6
3.1.11
The DP control system is a Kongsberg duplex system with redundancy of all components. The DP has three DGPSs, one HiPaP, one Fanbeam (temporary reference) and one Taut Wire as position reference systems for the station keeping of the vessel, and two wind sensors, two MRUs and three gyro compasses as environmental sensors.
REDUNDANCY CONCEPT OVERVIEW FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 7
4.
POWER GENERATION
4.1
Fuel Oil System

NC NC
Daily Service Tank 1
Daily Service Tank 2
NC NC
Fuel Settling Tank 1
Fuel Settling Tank 2
F#
F#
F#
F#
Fro! Fuel Trans P" To Fuel Trans P " FO Purifiers Fro! #eak Oil Tank
F( Diesel Generator 1
F#
F(
F#
Diesel Generator 2
F( Diesel Generator 3
F#
F(
F#
Diesel Generator 4
$e!ote o"erate% & C 'alve FO Booster P Ps
F( FO Cooler
F#
Flo) *eter
Figure 4-1: Fuel Oil System (Ref drawing No 320.01)
POWER GENERATION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 8
4.1.1
There are two service fuel oil tanks (fitted with low level alarms); each tank supplies two of the four diesel engines via a single remote operated quick closing valve for each engine. So provided each tank is available, DP class 2 can be achieved such that the worst-case failure can only cause the loss of two diesel generators. The effect of this failure is the loss of one switchboard and two of the four thrusters. This is the design worst- case failure and DP capability for work like dive support is based on this. The quick closing valves (QCV) are supplied to shut off the fuel flow in case of emergency. They are operated by hydraulic oil; each valve is fitted with an oil tank which is refilled by hand. There is a QCV activation lever for each tank so that in the event of accidental activation, only one FO tank will be affected and will not exceed the DWCF. The QCVs activating levers are not protected against accidental activation so it would be recommended that a protection device is put in place. Operation of the controls for quick-closing valves is from the Emergency Headquarters. Operation of the quick closing valves has to be intentional i.e. failure of valve seals etc. will not cause the valves to close. Loss of oil will prevent the QCV from operating when required to do so. Crossover lines are fitted between the two service tanks in the FO supply lines and FO return lines and fitted with normally closed (NC) isolation valves. These valves are manually operated and should be kept closed for DP2 operations. This should be included in the Engine Room DP Check List. The FO passes through a duplex filter alarmed for high differential pressure and a bypassable booster pump for each engine before entering the engine. Failure of the filter or the pump will only affect one engine. Power supply to the booster pumps are as follows: FO booster pump No. 1 FO booster pump No. 2 FO booster pump No. 3 FO booster pump No. 4 MSB 440V PS GSP1 (Back up from ESB) MSB 440V SB GSP2 MSB 440V PS GSP1 MSB 440V SB GSP2 (Back up from ESB)
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
The FO return lines from each engine returns to the same service tank from where it was originally taken through a FO cooler, one for each engine. The FO is cooled by the FW system. The FO cooler is a shell and tube type cooler heat exchanger and contamination of the fuel by water is possible.
4.2
4.2.1
FO System Failure Modes

The design separation is not necessarily adequate to ensure that a failure with a greater effect than the design worst case is impossible. Experience shows that it is always possible to blackout:
| 9
Failure Mode F.O. Starvation (two DGs) F.O. Contamination
Cause(s) QCV operate Filter blocked Pumps fail Leakage Water in fuel Microbiological contamination
Effects Unable to deliver demanded power Unable to deliver demanded power
Mitigation Other thruster compensates Other thruster compensates
Table 4-1: FO System Failure Modes
4.2.2
In the above circumstances, the power management system and DP control system will not know the reason for the loss in power. If there is under-voltage and underfrequency, the power will be cut back by the azimuth thruster frequency converter and there will be an increase in thrust and power on the healthy side of the switchboard. Thus, blackout and loss of position should be avoided. However, in the worst case there would be blackout on one side followed by a sudden step change in demand on the healthy side of the main switchboard. Provided the engines can deliver the power, negligible position excursion should occur. However if, after many hours of running at low load, they are unable to deliver power as expected, position will be lost. If the contamination is common to both fuel oil systems then blackout is possible even if the azimuth thrusters power is reduced significantly very quickly. The loss of power and thrust in this way is not considered a single point failure provided planned maintenance makes sure fuel oil contamination etc. is very unlikely and the engines are tested regularly so that the chance of them not being able to deliver on demand is very small. In these circumstances blackout would have more than a single point cause. Fuel contamination can cause serious problems on a vessel. The detrimental effects of microbiological contamination of the fuel oil can be eliminated by removal of water in the fuel, testing the fuel for microbe contamination and treating the fuel with biocides if microbes are present. However, it is unlikely that microbe contamination will cause a sudden failure; its effects will generally be cumulative. Contamination will be detected by the decreased fuel filter cleaning interval indicating the build-up of microbes in the fuel system. Water contamination in the fuel will result in erratic running with possible loss of engines. Fuel contamination will cause filter clogging and loss of generators. If the source of contamination is a service tank, both diesel generator engines might be affected at the same time. Prudent fuel treatment and fuel testing on new bunkers greatly reduces the risk of contamination. A regular fuel testing programme at bunkering using LR FOBAS is in place. In order to mitigate the risk from fuel contamination, the fuel supply to the engines should remain split in the port and starboard configuration so that the worst case scenario, contamination of a service tank would result in the loss of two diesel generator engines.
4.2.3
4.2.4
4.2.5
| 10
4.2.6
Correct fuel management techniques, including correct operation of the fuel oil purifiers, and regular draining of accumulated water from the fuel settling and service tanks, is essential to prevent water contamination affecting the operation of the diesel generator engines. In this vessel, procedures are in place for checking contamination of the FO service tanks. Fuel flow meters are installed. Care should be exercised so that they cannot fail and cause fuel oil starvation from line blockage. In the event of fuel oil filter high differential the pressure in the fuel suction main will drop below alarm level. This will result in the fuel boost pump starting automatically to increase the fuel pressure. However if the problem is a blocked filter, the improvement provided by the boost pump will be short-lived. Should fuel oil starvation take place, operators can quickly change filters or take other appropriate action, but care must be taken to prevent diesel engines tripping on overspeed because the demand is at maximum (fuel rack is fully open). Care must also be taken to vent air out of the fuel oil system as this can cause unexpected tripping just after the situation has been saved. Small pipe leakages should have little effect on the engine but greatly increases the risk of fire. Larger leaks, though of low probability, could result in loss of fuel to the engines, with the subsequent loss of the power generation and propulsion and ultimately loss of position. A leakage in a FO service tank will be alarmed by the service tank low level alarm. The failure of fuel lines is not normally considered in the FMEA; however the reliability of pipes and protection from damage should be well documented. A leakage in a FO pipe will be alarmed by a FO low pressure alarm. One of the most common causes of fire in engine rooms is a fine spray of fuel or oil that reaches hot surfaces such as exhaust gas or steam pipes; instrument lines and fittings becoming loose or breaking with vibrations can create this situation. This risk is reduced by proper insulation, screening, double piping, anti-spray tape and spray shields. This does not eliminate the problem but it helps to reduce it. Many safeguards are incorporated into modern engines such as those installed on OSV Relume.
4.2.7
4.2.8
4.2.9
| 11
4.3
Sea Water Cooling
Figure 4-2: SW Cooling System (Ref drawing 330.01)
4.3.1
One high sea-chest (port) and one low sea-chest (starboard) fitted with strainers supply water to a sea water main. Two sea water pumps take their suction from this main. The outlet from both pumps joins together in a common line before the SW enters to two plate central coolers (one online and one on standby). From the central coolers the SW is discharged overboard through a common line. Pipe segregation is not required for DP2 vessels (DP AA). The vessel will normally operate with one pump on line and one pump on autostandby. This has been confirmed by tests but relies on the stand by pump being available and not being unavailable due to a hidden failure. The standby pump function is tested frequently and pumps changed over on a regular basis. Seawater is only used for cooling the fresh water systems and provided it is reliable, this is acceptable for DP2.
4.3.2
| 12
4.3.3
Power supplies to the SW circulating pumps are as follows: SW circulating pump No. 1 SW circulating pump No. 2 MSB 440V PS GSP1 MSB 440V SB GSP2
4.4
4.4.1
SW Cooling System Failure Modes

The failure modes that need to be considered are as follows: Failure Mode Cause(s) Pump failure Air in system Poor maintenance Leakage (Burst Plate Cooler) Blocked intake Effects High FW Temperature Mitigation Standby Pump Can isolate leak
Inadequate Flow
Low Flow
Can use other suction
Table 4-2: SW System Failure Modes
4.4.2
There is a body of opinion that believes that plate coolers should be considered as active components so there is a requirement to make sure they are kept reliable. If the system is reliable then there are only two failure modes that are potentially critical and could cause high temperature shut down of all the diesel engines and hence a loss of position. The first of these is failure of the duty pump when the standby is not available. This could happen if only one of the two pumps is on line and the stand-by fails to start. This can be avoided for critical DP work. The second is a build-up of air in the system such that an air lock occurs; however, on this vessel the sea suctions are vented to deck in order to prevent air locks in the system. The sea water system flow is determined by the pumps and the valve setting which is manual. It is anticipated that full flow will be the norm and no active control will be used; temperature control is on the fresh water side. If the seaw a t e r inlet becomes blocked (marine growth plus plastic bag for example) operators should have low-pressure alarms a nd LT t e m p er a t ur e a la r m s before FW high temperature so that the other sea suction can be used. During sea trials, it was confirmed that under normal DP operational conditions the engines were able to operate for a considerable time before the engine HT temperature reaches the shutdown setting of 110C. Prior to shutdown, the LT temperature alarm, set at 45C, will activate, providing the watch keepers with adequate time to take preventive measures.
4.4.3
4.5
4.5.1
Fresh Water Cooling System

Ref Dwg 330.02 Fresh Water Cooling System The fresh water system is also common but there is an expansion tank and a buffer tank so that there will be two alarms if there is leakage in the system that might
| 13
threaten blackout from loss of cooling to all diesel generators. The system has two plate coolers and two 100% circulation pumps so the design philosophy is for one to be on line and one to be on auto-standby. This common cooling system supplies the thruster coolers, the converter cooling system, fuel oil coolers and start air compressor cooling. 4.5.2 The bow thruster and azimuth thruster motors and azimuth thruster oil coolers are FW cooled but the converter coolers (fan/coil units) are part of the closed system for each converter. The FW system is the cooling medium used in their dedicated plate coolers.
Figure 4-3: Fresh Water Cooling System
4.5.3
The expansion tank is 1100-L capacity and the buffer tank is 900-L capacity. The operator will know there is a significant leak (Red Alert) if both alarms take place in quick succession. The fresh water temperature control has two sets of control loops, one for each diesel engine between HT and LT circuits and one for each plate heat exchanger. The HT circuit cools the cylinders and cylinder heads. The LT circuit consists of a charge air cooler and a lub oil cooler through which a pump circulates the water. The temperature
4.5.4
| 14
control valves are Amot ( wa x e le me nt ) and once set up they should operate adequately. If there is a control problem, manual adjustment of the plate cooler thermostatic valves is possible. 4.5.5 Power supplies to the FW circulating pumps are as follows: FW circulating pump No. 1 FW circulating pump No. 2 MSB 440V PS GSP1 MSB 440V SB GSP2
4.6
4.6.1
FW Cooling System Failure Modes

Failure of one pump could be critical if the standby pump failed to start (hidden failure); however this risk is mitigated, in part, by regular testing and changeover of the running and standby pumps. If leakage occurs, the header tank low-level alarms will activate before any loss of pump pressure. During trials, with FW cooling system shutdown, the thruster converters are designed to alarm at 55oC and shutdown after 20 mins.
4.6.2
Failure Mode Inadequate Cooling
Cause(s) Temperature control valve fault Leakage from cooler Air in system
Effects Alarms High D.G Temperatures Risk of blackout
Mitigation Early warning Isolation possible Temperature rise not instant Standby pump
Table 4-3: FW Cooling System Failure Modes
4.6.3
The system is well designed and reliable. The risk of leakage, i . e . f l e x i b l e p i p e , r u b b e r c o u p l i n g s , being excessive so that isolation is not possible in good time is small. However leakage is not considered as a failure for DP2 vessels. The two pumps are powered from the split 440V switchboard. If the stand-by is unavailable then the vessel cannot be considered as working in the safest (Class 2) mode. The most likely cause of the loss of cooling water is the failure of a flexible coupling at one of the four diesel generators. This can occur due to excessive engine vibration. Operators must pay close attention to these couplings and inspect them as a matter of routine maintenance. More common failures of the FW cooling system are related to malfunction of one of the thermostatic valves which then fails to regulate the FW temperature and causes the shutdown of the engine for high temperature if the operator does not take action early enough. These are Amot valves as mentioned above, normally with several elements per engine. These elements usually fail one at a time so the watchkeeper should be able to notice a failure of one of the elements and take remedial action. Failure of the wax element 3-way temperature control valve will cause temperature variations but should not cause an immediate shutdown of the engine.
4.6.4
| 15
4.7
L.O. System
Figure 4-4: Engine LO System Schematics
4.7.1 4.7.2
The engines are wet sump i.e. the system oil is stored in an integral sump pan. There is no common lube oil system for the diesel generators, each is independent with a motor driven pre-lube oil system and an engine driven circulation once the diesel generation is running. The lube oil to any one generator can be changed or filtered separately by using dedicated pumps, so the failure modes are reasonably limited to one engine. The engine driven pump sucks oil from the engine oil sump and forces it through the lubricating oil cooler equipped with an Amot thermostatic valve regulating the oil temperature, through the lubricating oil main filter to the main distribution channel in the engine block, and via side screw bores to the main bearings. The oil cooler, thermostatic valve and the main filter are mounted on the engine. Part of the oil flows through the bores in the crankshaft to the big end bearings and further through the connecting rod to the gudgeon pins, piston skirt lubricating and piston cooling spaces. Oil is led through separate pipes to other lubricating points, like camshaft bearings and valve mechanism gear wheel bearings, and to oil nozzles for lubricating and cooling. The pressure in the distributing pipe is regulated by a pressure control valve on the pump.
4.7.3
| 16
4.7.4
When the DG starts and the LO pressure reaches 2 bar, the pre-lub pump stops. If the pressure drops below 2 bar the pre-lub pump starts. If an engine stops and the pre-lub pump fails to start, the engine can be started again within three minutes. Power supplies to the electric pre-lub pumps are as follows: Pre-lub pump No.1 Pre-lub pump No.2 Pre-lub pump No.3 Pre-lub pump No.4 MSB 440V PS GSP1 (Back up from ESB) MSB 440V SB GSP2 MSB 440V PS GSP1 MSB 440V SB GSP2 (Back up from ESB)
4.7.5
4.8
4.8.1
LO Cooling System Failure Modes

Any failure in the LO system will affect one engine only. The failure modes that can contribute to an effect greater than the loss of one diesel generator engine are generally concerned with a standby machine not starting and coming on line when needed because of a lube oil low- p r e s s u r e sensor fault or the pre-lube logic being faulty. These failure modes were tested during trials. The pre-lube oil pumps should be running on all standby machines. The diesel generator engines have a blackout start facility whereby they are allowed to within 5mins of blackout providing the LO priming pump was running prior to the blackout. Pre-lube pump starts when DG engine stops, and stops when DG engine starts. Failure of the pre-lubricating pump will give a start block signal. A generator will not start if the pre-lub pump has not run in the previous 4 minutes. Low LO pressure will raise an alarm. Low-low LO pressure will raise an alarm and the engine will shut down. The LO alarm system for alternator bearings is critical. The bearings are fitted with temperature sensors which provide an alarm at 110C and shutdown of the engine at 120C. Lube oil contamination microbiological or by fuel, oil is possible but this is unlikely to affect more than one diesel engine at any one time. Failure of the wax element 3-way temperature control valve will cause temperature variations but should not cause an immediate shutdown of the engine.
4.8.2
4.8.3 4.8.4
4.8.5 4.8.6
4.9
4.9.1 4.9.2
Compressed Air
The starting air system is also common with redundant active components and compressors. There are two Main Air Receivers and one Control Air Receicver. In addition to the start air compressors, there is a Control/Working air Compressor and an Intering Stabiliser Compressor. The working air compressor has a capacity of 66m3/hr. at 12bar. This compressor is fitted with an 800l receiver and filter/drier unit. Air from this system is used to supply the azimuth thruster header tanks and the taut wire unit. The intering stabiliser compressor has a capacity of 44m3/hr @ 12.3 bar and
| 17
a 500l integrated receiver. This compressor can be connected to the service air system if required.
Figure 4-5: Compressed Air System Layout
4.9.3
Each azimuth thruster has a pressurised header tank as there is inadequate height at the stern above the thruster to accommodate the required head of oil. The tank is pressurised by service air that is reduced from 8 bar to 1.5 bar. The air is supplied to the header tanks via non-return valves and therefore loss of air will have no immediate effect. A back-up air supply is available from either the start air system or the secondary service air compressor with integral 250l receiver. The azimuth header tanks and the service air system are alarmed for low air pressure; hence, the operator will be informed should loss of air pressure occur. A safety valve is fitted to the thruster air supply to prevent over-pressure. The pneumatic system is not supplied by Rolls Royce. Control air is also used for the thruster i n p u t s h a f t brake but this is only used when thruster maintenance is in progress and the thruster is not available. Power supply to the air compressors is as follows:
4.9.4
| 18
Starting Air Compressor No. 1 Starting Air Compressor No. 2 Control Air Compressor Intering Air compressor
MSB 440V PS GSP1 MSB 440V SB GSP2 440V MSB PS PDP2 (440V MSB PS)
4.10
4.10.1
Compressed Air System Failure Modes

For loss of starting air to be critical there has to be two failures namely, a loss of one or more diesel engines and a loss of starting air so that they cannot be restarted or another brought on line. Failure of one starting air compressor will not affect the air supply as the second compressor will still be able to supply sufficient compressed air. If one of the two air receivers is kept filled and isolated, there will always be a full supply of air to start a main engine. Loss of starting air will not have an effect on the running main engines. Failure of the control air compressor will not affect the service air supply as there is a crossover from the start air system ensuring sufficient compressed air supply is maintained. Loss of service air to the azimuth thruster header tank would result in an alarm but would have no immediate effect on the thrusters and hence DP.
4.10.2
4.10.3 4.10.4
4.10.5
4.11
4.11.1 4.11.2 4.11.3 4.11.4 4.11.5 4.11.6 4.11.7
Ventilation
The engine room has four fans, one supply/exhaust fan and one supply fan in the starboard side and supply/exhaust fan and one supply fan in the port side. The bow thruster room has two ventilation fans, one supply and one exhaust fan. The aft thruster room has one supply/exhaust fan and one supply fan. The engine control room is supplied with its own separate AC unit which is fitted with two fans. The bridge is equipped with an AC unit which has two fans. This also supplies the void space where some electrical and navigational DP equipment is located. The alternators and the diesel generator engines are FW cooled and the convertor drives are ventilated with water cooled fan assisted air cooling units. Power supplies to the ventilation fans and AC units are specified in the Power Distribution section. (See sections 4.20, 4.21)
| 19
4.12
4.12.1
Ventilation failure Modes

In the event of failure of one ER fan, the speed of the remaining fans is increased to high speed, which has been proven to provide ample air for the engines. Failure of one side of the 440V board will also fail half the ventilation to the engine room, the azimuth thruster room and the bow thruster rooms. If the engines are still running then a temperature rise may occur but the rise will be slow and there will be enough time to cease the work and reach a safe situation. Failure of an engine room ventilation fan also causes the fire damper to close. Failure of a ventilation fan is alarmed to the operator. The air conditioning systems critical to DP function, are located on the bridge and ECR. The air-handling units for these systems are cooled by the three chiller plants located in the ER. Any one of the three chiller plants can be used for the bridge or ECR AC systems. Both units are fitted with spare fan motors and if the control system fails, manual operation of the control valves is possible. Disintegration of the fan would be a problem until it was replaced. To keep working a portable fan could be employed otherwise the work could be terminated until the repairs were made. There should always be time to safely terminate the work. A particular failure mode that has been experienced in the past on some vessels is loss of AC followed by condensation on cold surfaces of the DP control system, resulting in failure. Failure of the AC is alarmed and the motors for the system are supplied from both switchboards.
4.12.2 4.12.3
4.13
4.13.1
Diesel Generator Engines

The vessel has four diesel generator sets, two to port, one behind the other, and two similarly arranged to starboard. They are similar Wrtsil engines ( 8 L 2 0 C 2 a n d 6 L 2 0 C 2 w i t h t u r b o c h a r g e r t y p e ) but of each pair, one is a six cylinder, 1000kW unit and the other is an eight cylinder 1300kW unit. The engine room is one space from a fire and flood perspective but there is a longitudinal acoustic bulkhead which provides acoustic separation. There is one Caterpillar Emergency Diesel generator set of 145kW. For the vessels AA (DP2) notation the main switchboard will be split with one or two diesel generators on line each side. The limits of operating with just one diesel engine each side depends on which pair of engines is on line and the environmental conditions at the time but with a 1 + 1 arrangement the second DG should be on line as soon as the load reaches 50%, otherwise there will be a loss of position from the failure of one DG. The engines will shut down in the following events: LO pressure shutdown (below 2 bar) High temperature shutdown (110) Main bearing shutdown (120) Overspeed shutdown (15% more than 900rpm)
4.13.2
4.13.3
| 20
4.13.4
The engines are fitted with LT and HT FW engine driven pumps, FO engine driven pumps and LO engine driven pump. They are not fitted with Oil Mist Detectors (OMD). The engine HP fuel pipes are double skin pipes and protection covers are fitted to engine exhausts and fuel equipment to minimise the risk of fuel impingement on exposed hot surfaces. There are two 1300kW/690V alternators type NIR 5670 A-8LW type and two 1000kW/690V alternators type NIR 5656 A-8LW The alternators run at 900RPM and rated at 1625 kVA/1250kVA at 0.8 power factor, 3-phase, 690V, 60Hz. For cooling, the alternators have an air/FW cooling assembly that consist of recirculating air cooling channels within the alternator frame and the air/water exchanger. The governors are Woodward 723 digital controller with hydraulic UG actuators with self-contained oil sump. The 723 controller is interfaced to the PMS for remote and automatic control. The actuator hydraulically converts the 4-20mA (0- 100% speed) input from the 723 governor into mechanical power to control the fuel rack. Speed feedback is input to the 723 governor by two magnetic pick up sensors installed by the flywheel. The Woodward 723 digital controller for the generator is supplied by local transformer rectifier units from the diesel generator, once it is running, via a 690/230V transformer. Each engine is provided with a WECS (Wrtsil Engine Control System) panel. The WECS system functions are: speed measuring system safety system display including all measuring instruments serial communication with the engine Data communication with external systems Power supply to the WECS is as follows: Main supply DP 24V MSB2 24V DP 24V MSB2 24V Back up supply MSB2 24V DP 24V MSB2 24V DP 24V
4.13.5
4.13.6
4.13.7
4.13.8
Equipment WECS DG No. 1 PS Fwd. WECS DG No. 2 SB Fwd. WECS DG No. 3 PS Aft WECS DG No. 4 SB Aft
Table 4-4: Main Engine WECS Power Supplies
4.14
4.14.1
Diesel Generator Engines Failure Modes

For the vessels AA (DP2) notation the main switchboard will be split with one or two diesel generators on line each side. In these circumstances, the worst- c as e failure will be blackout on one side, port or starboard. However, there are several failure modes that can cause the loss of one or two diesel engines. The fuel oil and
| 21
cooling water failures have already been discussed. The additional failure modes are as follows for cases where two diesel generators are on line each side: Failure Mode Excessive vibration Cause(s) Mechanical damage Control fault Control fault Effects Reverse power trips Low F.O. pressure Low LO trip. High temp. trip One D.G. trips Other on reverse power Operator trips faulty machine (risk of stopping healthy one by mistake) Mitigation Other engines
Overspeed Instability
Other engines Other engines
Table 4-5: Main Engines Failure Modes
4.14.2
The risk of mechanical damage is small. If an engine is not performing well this should be evident and the operator should initiate starting of the other engine (if not on line) and shut down prior to the engine tripping. This action should cause an amber alert and cause divers to return to a safe position if the vessel is engaged in diving support work. For this vessel, mechanical damage to one engine is unlikely to physically damage another but instability or overspeed of one could cause both to fail and the vessel to rely on the other engine(s) on the other side of the vessel. When the control of one engine causes instability, it is equally difficult for the operator, as the instrumentation and protection, do not identify which is the faulty machine and which machine is following. There have been instances where the operator has tripped the healthy engine and then the unhealthy engine also trips. Failure of power supply to the Woodward governors will cause the engine to stop. Failure of one speed sensor will give a governor minor alarm and the engine will still function with the other sensor. Failure of both should initiate a shutdown, the engine will trip and a standby generator will start and connect. The chance of both failing to give a similar incorrect non-zero reading is considered negligible. Failure of the AVR may fail the excitation and/or cause the diesel generator to be
4.14.3
4.14.4
4.14.5
unstable and trip.
4.15
4.15.1
Power Management System

The vessel is fitted with an Alarm, Monitoring and Control System. This system covers the requirements for an unmanned engine room, the remote monitoring starting and stopping of equipment, the audible and visual alarms and the power management. The whole system is integrated with data being transmitted over a redundant Ethernet network with two independent LAN connections. The main server is located in the engine control room and the back-up server on the bridge.
4.15.2
| 22
4.15.3
Each engine PMS unit has a direct supply from UPS port or starboard. The supplies are diode protected. A second supply is provided from the generator, via a transformer/rectifier, once the machine is on line. There are Server and Client computers located in the ECR and on the bridge, under normal conditions the ECR Server is in control, in the event of it failing, control is taken by the Bridge Server. Access to the system from the ECR will then be via the client computer. Both servers are supplied from the Praxis UPS. The ECR client is supplied from NLDP4 and the bridge client from NLDP1. All workstations are also protected by a local dedicated UPS. The system has 11 intelligent I/O cabinets: each has a 24V-dc power supply. The units and their function are shown the following table.
4.15.4
4.15.5
ID
DPU1
DPU2
DPU3
DPU4 DPU5 (XS316 XS317) DPU5 XS318 DPU7 DPU8
UNIT FUNCTIONS DG1, DG3, BT1, PS PM PS Tanks, Auxiliaries & SWBD DG2, DG4, BT2, SB PM SB Tanks, Auxiliaries & SWBD Thruster Control PS PM, Drive & Azimuth PS Tanks & Auxiliaries SB PM, Drive & Azimuth SB Tanks & Auxiliaries BT Alarms, ESB Monitoring & Auxiliaries BT2 Starting, Bridge Alarms SB PM Indication PS Pumps SB Pumps
LOCATION Engine Room PS Tween Deck Fr 71
POWER
MODULES
PRAXIS UPS cct F11
13
Engine Room SB Tween Deck Fr 71
PRAXIS UPS cct F12
10
Carpenters Workshop Hold PS Tween Deck Fr 62
PRAXIS UPS cct F13
10
PRAXIS UPS cct F14 PRAXIS UPS cct F23 MSB1 24V cct Q23 PRAXIS UPS cct F21 PRAXIS UPS cct F22
Bridge FWD Console PS Bridge FWD Console PS Group Starter Panel No. 1 Group Starter Panel No. 2
2 3 3
Table 4-6: Alarm & Control System I/O Units
| 23
4.15.6 4.15.7
All Server and Client Workstations are inter-connected via a redundant high-speed network and uses two coaxial cables, one for main link and one for back-up link. The operation of this redundant network is such that either the Main or Backup network can take control in case of any the other failing. LAN network arrangements can be referred to in drawing 394-440-100-LDS-001 sheet 101 Rev 1. The system has four dual field bus networks (CAN-bus). Number four is for watch keeping, (unmanned engine room) alarm monitoring and calling. This does not concern operations in DP2 on the basis that the engine control room will be manned during operations. The other three are configured as follows: This shows that the port diesel engines and port thruster drive are controlled and monitored by No. 1 dual network while the others are on No. 2 dual network. The remainder are on field bus No. 3. Thus, port and starboard separation is achieved.
4.15.8
4.15.9
4.15.10 Each diesel engine has an individual PMS module (PS 3500), which is linked by a dual redundant CAN-bus so that the loss of one link will only cause an alarm but no power management malfunction. If both are lost from one module, however the PMS can act to control the machine independently of the others. The serial data bus is used for load sharing and data transfer to the AMCS (Alarm, Monitoring and Control System). All four diesel engines will run in droop mode but be adjusted by the PMS system to achieve load sharing. Each PMS module has a 60 Hz reference and it is this that is used for load sharing. Each PMS module is powered by different internal feeders in the 690V main switchboard. They are galvanically isolated by converters capable of withstanding spikes and interference from the main power cables and bus bars. FIELD BUS 1 2 1 2 3 3 3 3 DPUs 1 2 3 4 5 7 8 11-14 DATA DGs 1 & 3 Port DGs 2 & 4 Starboard Thruster Drive Port Thruster Drive Starboard Wheelhouse Group Starter Panel 1 Group Starter Panel 2 HVAC
Table 4-7: Alarm & Control System Network Configuration
Note: DPU 6, 9 and 10 do not exist, these numbers are reserved for future developments. 4.15.11 When the main bus tiebreaker is open the port PMS modules and starboard PMS modules are made independent of each other by opening the hard-wired contact from the bus-tie breaker to each PMS module. In this state, there is no communication between the two sides. 4.15.12 In general the PMS has two operating modes: OFF: in this case the PMS module (1 per generator) involved will be down.
| 24
MANUAL: in this case the operator gives commands for START/STOP, switching ON/OFF and RAISE/LOWER in order to synchronise and regulate load; commands can only be given on the switchboard PMS panel involved. AUTO: in this case the operator can gives commands for START/STOP the diesel generator set or tie breaker on/off, afterwards the automation starts, synchronise and switched on, shares the load over the remaining generators in parallel. Furthermore the PMS starts and stops diesel generator sets depending on load of generators. In Automatic mode the operator commands can be given on the switchboard (local) or via AMSC (Mimic). General functions like synchro check, protection functions, (remote) signalling functions, etc. are available in both modes. Transitions between MANUAL or AUTO modes should not result in starting/stopping or switching ON/OFF without operator command.
4.15.13 On the diesel engine there is a LOCAL/REMOTE possibility and START and STOP facilities. If switched to local, the PMS is forced to MANUAL mode and only control from diesel engine is possible. If switched to remote at diesel engine, control is only possible from PMS.
Failure Mode One PMS fail One PMS link fail Both PMS fail Loss of DPU 3 or DPU 4 Loss of DPU 1 or DPU 2 Loss of DPU 5 False bus-tie breaker status to PMS
Cause(s) Power loss or over voltage Wire break Non alarm on other Operator error Internal short Internal short Internal short Wire break Breaker fault
Effects One DG stops None DG independent Loss of azimuth thruster indication Loss of diesel Engines indication All engines still run
Mitigation Other engine Dual power Use other Alarm Other side OK Other OK Other OK Information only Should not cause tripping
Table 4-8: Alarm & Control System Failure Modes
4.15.14 Remote commands are possible from MIMIC via AMCS. Starting, stopping, close, open control of the diesel generators breakers, 690V tiebreaker, shore breaker and nonessentials (only off) is possible. Local operation is also possible, for each generator a power management control panel is mounted in front of the respective generator field. 4.15.15 System functions of the Power Management System include: Manual and automatic start/stop Automatic synchronising Power measurement (3 phase) Symmetric/asymmetric load sharing
| 25
Load dependant start/stop Blackout monitoring/start Stand-by selection Continuous or periodic running of LO priming pumps Monitoring of critical parameter such as under voltage, over voltage, under frequency, over frequency, overload Generator protection with circuit breaker trip in case of reverse power, short circuit and/or over current Engine shutdown on low LO pressure, high cooling water temperature and overspeed
4.15.16 The following generator control and protection functions are integrated in the PMS: Reverse power trip Short circuit trip Over current trip Overload alarm Under and over voltage alarming
4.15.17 Shutdown of an engine and open circuit breaker will be activated in case of: Overspeed LO low pressure Cooling water temperature high
4.15.18 In automatic mode, the PMS controls the number of generators running in parallel depending on the actual load, and pre alarm signals of engines running. Operator defines priority of generators running. A diesel will start if the generator power (kW or kVA) reaches a pre-set limit of the generator power. This value is adjustable. At the PMS Mimic a stop blocking is available, to be ensured that there is enough generator power for manoeuvring. 4.15.19 If the power demand decreases to a level which allows one alternator to be stopped without the system being on the power limit, then one set is to be shut down after a preselected time limit has elapsed. Indication is to be provided to the control, alarm and monitoring system if the load demand does not increase. After a predetermined period of between one and two minutes prior to shutdown an audible warning of shutdown is incorporated. Override or accept shutdown buttons are provided in wheelhouse for use in transitory load reduction cases. 4.15.20 In automatic mode, the PMS controls both frequency and power distribution of the generators. Load will be equally divided over parallel running generators with respect to the nominal power. In Manual mode operator commands raise and lower will control both frequency and power.
| 26
4.15.21 The diesel engines have their own independent protection (Wrtsila). The PMS receives a shutdown signal from the diesel engine. The PMS protects the generators from the following events: winding temperature too high (each winding) bearing temperature too high (each bearing). 4.15.22 An AMCS pre-alarm will be generated for the above-mentioned signals, for cooling air and water leakage. A pre-alarm will also start a stand-by diesel generator. The diesel generator with the pre-alarm will stop, when the stand-by one is running. If there is a lack of power, the diesel generator with a pre-alarm will not be stopped. A too high alarm will stop the diesel generator directly. 4.15.23 In case of a blackout (normally prevented by the PMS by limiting power) the selected stand-by diesel generator set will start to feed the MSB 690V. The diesel generator starting order can be selected via the Mimic parameters incorporated in the AMCS. Also the primary ship main service transformer circuit breakers and the tiebreaker will return to their state before the blackout. For example, if the operator has chosen to sail with an open 690V tiebreaker and one 690V transformer SB in service, and a blackout occurs, the situation before the blackout will be restored by the PMS. Thus only transformer SB breaker will be switched on (and all starters which were running). 4.15.24 To avoid unwanted load-steps each generator must be unloaded before switching off (in automatic mode), this means the load delivered by the generator must be automatically reduced to about zero before circuit breaker opens. This function is, of course, only possible if more than one generator is running in parallel and is done automatically. 4.15.25 The emergency generator is not a part of the PMS. If a blackout occurs, the tie breaker to the MSB 440V will open, and the emergency generator starts to feed the Emergency Switch Board. Continuous parallel operation with the MSB 440V is not possible, but a bump less take over is possible in manual operation. Synchronizing is only possible over the tiebreaker at the ESB 440V. The operator has to synchronize with the speed buttons of the emergency generator to the MSB 440V, close the tiebreaker and stop the emergency generator. The generator breaker opens automatically when the tiebreaker closes. 4.15.26 The 440V MSB bus-tie is normally open to prevent parallel operation of the 690/440V transformers. The feeders of the bus bars (transformer and shore breakers) can be switched on to a dead bus only. Those breakers are equipped with independent under voltage release. When the transformer breakers are in AUTO ON position, the breakers are closed automatically, if the ship main service transformer 690/440V is energized. 4.15.27 In automatic mode synchronising is done by the PMS (also operator close /open is possible) to connect the PS and SB bus bar. In manual mode (pushbuttons on tiebreaker panel) closing is only possible with a dead bus PS or SB. Manual synchronizing is possible for all 690V generator breakers. 4.15.28 All 690V feeders breakers have an independent under voltage release, except for the bow thrusters circuit breakers. There is no PMS control of those feeders except the primary ship main service transformer circuit breakers.
| 27
4.15.29 In blackout situations the PMS starts generators (in AUTO mode) in order to restore the voltage. Also the primary ships main service transformer circuit breakers and the tiebreaker 690V will return to their state before the blackout. The ships main service transformer circuit breakers PS/SB must be sequential switched on with a time interval of 2 sec. The PMS/AMCS also sequentially restarts starters, via the AMCS I/O, necessary to restore safe ship operation according to LRS. Hence, all items to restart must be remote controlled by AMCS. So all AMCS controlled starters can return to their state before the blackout. All outgoing feeders / groups of the MSB 440V and ESB 440V will return to their state before a blackout at the same time. 4.15.30 Due to high inrush current of the propulsion transformers and bow thrusters there is a start allowed signal for starting. Starting is only allowed when two generators are connected to the bus bar of the PS/SB propulsion drives or bow thrusters. These signals are relayed via local AMCS I/O, and generated by the PMS modules. The bow thrusters only send a request for starting. 4.15.31 There are three means of limiting the total amount of power. These are: switching off the non-essential consumers, limiting the speed/torque of the propulsion motors and reducing the pitch of the bow thrusters propellers. A safety factor of 0.95 (adjustable) is be used to calculate the maximum allowed power. This is necessary because the main diesels will not be able to produce the rated power of the generators at an Engine Room temperature of 55C. Also 200kW is reserved for load fluctuations in the 440V distribution. The generator power (kW and kVA) is measured and used as a reference. 4.15.32 In case of overload, the load shedding groups will be switched off by PMS in two stages. First, the PS 440V consumers will be switched off and afterwards the SB ones. The individual feeders must be switched on manually. The non-essential groups can be manually switched off (pulse 1 sec) via the PMS mimic. If there is diesel generator shutdown or breaker trip, load shedding (PS&SB) takes place immediately in case of a lack of power. In all other cases switching off is delayed (adjustable). This is because, first of all, the propulsion /bow thruster power will be limited. 4.15.33 An analogue (-60 to 120% of nominal power 1500kW) and a digital signal will be sent to each propulsion drive, to limit the amount of power. The PMS will calculate the available power for each drive in respect to the power plant configuration. This analogue signal represents the maximum available (+ or -) power. Thus 0% (=9,3mA) means limiting the power and below 0% reducing the drive power. When there is for example 500kW running generator power left, the signal will be (500-200)*0.95/1500= +19% (=11mA). This means that the drives can use this power to speed up until actual power + 285kW. A power-limited lamp indicates to each control station that there is a lack of propulsion power. When a diesel generator trips, a fast digital signal (NC) will immediately reduce the drive power to 100kW for about 3 sec. The 100kW is based upon 400kW consumer power, 2x400kW bow thrusters and 150% short time overload capability of 1 diesel generator. When this digital signal is deactivated, the drive listens again to the speed set point limited by the stabilized analogue one. 4.15.34 Only a single analogue (0-120% of nominal power 515kW) will be sent to each bow thruster for limiting the power. In case of a lack of power on PS or SB, the thrusters will be reduced / limited. This is because the Rolls-Royce system will reduce the pitch when the signal is higher than 100% (17,3mA=515kW). If the signal is 120% big steps are taken and near 100% small steps. For example when only 2 diesel-generators of
| 28
1000kW are available the 690V tie breaker is closed and a total consumption of 1200kW, the limit value will be (800kW-200kW)*0.95 = 570kW. So the actual limit set points are: for the bow thrusters (1,00-570/515)*100=0%[between 0-120%]; negative values equals 0% for the propulsion drives 570/1500*100=38%[between 60- 120%].
Or in case of a lack of power of 10kW it will be (-10kW-200kW)/0.95=-221kW with the actual limit set points: for the bow thrusters (1,00- -221/515)*100=120%[between 0-120%]; values above 120% equals 120% for the propulsion drives -221/1500*100=-14,7%[between 60- 120%];reducing power with 221kW.
4.15.35 In DP mode, the status of generator and bus-tie breakers and the generator load is sent to the DP controller which limits the set points, thruster speed and bowthruster pitch, depending on the input values. In all vessel operating modes, i.e. DP, DP Joystick, Manoeuvring and Transit, the PMS is active. 4.15.36 The Kongsberg DP control system power reduction limits (black out prevention) are set up as follows: Upper limit (cut in) set to generators 85% power Lower limit (Cut out) set to generators 75% power
4.15.37 When operating in DP2 in open water on two connected generators the bus tie must be open at all times with the auto start limit for the standby generators reduced to 50% full load to prevent overload of the system and this should be included in the DP check list. 4.15.38 Failure of synchronisation of two generators will be alarmed to the operator. 4.15.39 Auto-start of a standby generator and connection to the board takes up to 45 sec. For the emergency diesel generator takes up to 30 seconds.
| 29
Figure 4-6: PMS Layout
| 30
4.16
4.16.1
Power Balance
Generated power with all four diesel generators on line is 2300kW of power available for each side of the main switchboard. Each bow thruster consumes 515kW at full power while each stern azimuth thruster can consume 1500kW. Thus if one side of the switchboard is lost and the thrusters were at 50% there is not enough power for one side, with both DGs on line to supply the full DP load if allowances are made for the domestic load. This assumes that on the worst case failure the two remaining thrusters have to supply 100% thrust. In practice, the thrust of the stern azimuth thrusters has to be limited so that overload is avoided. Calculations from the builders show that about 90% power would be available and that with an open bus-tie breaker it is quite straightforward to limit the power (DP control system) and cut back the power of the azimuth thrusters because they have frequency drives. These arrangements are satisfactory provided there is no risk of incorrect or missing data that can: Prevent a cut when one is needed Cause a cut when one is not needed
4.16.2
4.16.3
4.16.4
If operating with two DGs on line (1 + 1 open) and one thruster went to full power, there is a chance of overload and blackout on that side. The other side would have to recover the position and heading excursion, which would not be possible until the second DG, started and came on line and then it might be too late.
4.17
4.17.1
Engine Room Fire

DP Class 2 does not require separate engine rooms but the risk of an engine room fire is much higher than the risk of fire in other spaces and close attention is needed to ensure prevention, and prompt detection and extinguishing a fire in the event that one occurs. The system on this vessel is designed so that no single fault can cause a false shutdown. The CO2 relay box has two independent power supplies and additional switches added to the release boxes power distribution. A Hi-Fog system provides fire protection in five machinery space zones i.e. DG1, DG2, DG3, DG4 and purifier.
4.17.2
4.17.3
| 31
4.18
690V Main Switchboard
Figure 4-7: Electrical Distribution System (Ref drawing 300144-400_000-GRS-001 Single Line)
4.18.1
The main switchboard is 690V 60Hz and can be split by a single bus-tie breaker and at least one generator running on each switchboard with the other generators in stand-by (depending on the load). This will be normally open for DP2 work so that any fault should be restricted to the failure of just the port or starboard side of the switchboard. There are many faults that can cause the loss of the switchboard and these are listed below: short circuit loss of excitation on one diesel generator trip of one diesel generator and overload of second trip of both diesel generators (fuel oil) AVR fault with one diesel generator that causes loss of both
| 32
PMS fault with one diesel generator that causes loss of both. 4.18.2 The number of causes is not as important as the frequency of their occurrence. All of the above have taken place in the past on other vessels. Only the first is an unavoidable blackout, the others should not occur even though the effect should only be the loss of half the power and thrust. Configuration of Main Electrical Plant is controlled by the PMS, with the exception of the emergency generator and 440V tiebreaker. The PMS is incorporated in the MSB 690V and AMCS. Also the essential starters and non-essential consumers (load shedding) are controlled by the PMS. The 1000 kW generators do not have a differential protection device and are controlling the bus tie breaker via the PMS as well. The 1300kW generators are also controlling the transformer circuit breakers via the PMS. The circuit breaker of the propulsion thrusters is only controlled via the frequency drive to prevent damage to the frequency drive converter. Switching on is interlocked (in auto mode) when only one generator is in operation. Starting of a bow thruster is interlocked (in auto mode) when only one generator is in operation. The transformers are switched on via pre magnetizing resistors to prevent a high inrush current. If the selector switch is in auto position, the transformer circuit breaker will be controlled by the PMS (panel of the 1300kW generator or mimic). The tie breaker panel, in local mode, switching on is only possible via a dead bus on PS or SB. The PMS (panel of the 1000kW generator or mimic) controls the system when in auto mode. The insulation monitoring devices are measuring stand-alone when the bus bars are split, and one is in charge when the bus bars are coupled. Each PMS module can operate in 3 modes, Off / Auto / Manual. These modes depend on the following signals: Off: Engine in Local control; Manual: Selector switch on diesel engine control panel is in remote position and on PMS panel is Manual selected; Auto: Selector switch on diesel engine control panel is in remote position and on PMS panel is Auto selected.
4.18.3
4.18.4
4.18.5
4.18.6 4.18.7
4.18.8
4.18.9
4.18.10 Selection Auto / Manual is done via the PMS display panel or via the PMS graphic display. 4.18.11 If the selector switch on diesel engine control panel is in local position, the PMS is forced to Off mode, only the plant safeties are active. 4.18.12 If the selector switch on diesel engine control panel is in remote position the PMS starts in Manual mode and after this the operator can select Auto mode. 4.18.13 The bus-tie can be operated from the graphic or from display panel PMS-2 or PMS-3. The system will remember the last operator command and will recover to this state after a black out. The PMS only closes (synchronise) the bus-tie if both busses are healthy (generator in operation on each side). The tie breaker cannot be switched off in automatic mode to prevent a black out on a bus bar part. According to LROS the tie
| 33
breaker must be opened manually in case of DPAA sailing mode in order to increase safety. 4.18.14 The transformer breaker (PS/SB) can be operated from the graphic or from display panel PMS-1 (PS) or PMS-4 (SB). The system will remember the last operator command and will recover to this state after a black out (only if the selector switch on the transformer panel is in auto mode) The PS / SB transformer are interlock by the PMS so only 1 transformer can be closed. When sailing in DPAA mode the tie breaker in the 690V MSB as well as in the 440V MSB must be opened and both the circuit breakers of the transformers must be switched on in order to increase safety.
4.19
4.19.1
690V Main Switchboard Failure Modes

A switchboard could fail for various reasons, such as phase-to-phase fault, earth fault, and overload. The current design and DP2 operating configuration will prevent a blackout; the remaining risk for the main switchboards comes from the incorrect settings of the systems relays, due to drift or initial commissioning engineer mistakes. The protections are set to protect and discriminate between power system configurations. Even with this type of hidden failure the design worst case failure should not be exceeded; this relies on the remaining systems being able to deliver twice their previous load rapidly and the vessel being operated within its capability plot for design worst case failure. Failure of one main switchboard section will cause the loss of two thrusters, one bow thruster and one aft propulsion thruster.
4.20
4.20.1
440V Switchboard
The main 440V switchboard is also in two sections with a single bus-tie breaker that is normally open whether the main switchboard is open or closed. Each side is powered via 1400kVA transformers. The two transformer circuit breakers and the tiebreaker are interlocked; only two of them can be closed to prevent paralleling of the 690/440V transformers. The breakers are manually controlled. If the selector switch is in auto position, the transformer circuit breaker will be switched on at the return of the secondary transformer voltage. If the tie breaker is open then both transformer circuit breakers will be switched on. In DP mode the tie breaker must be opened and both transformer circuit breakers closed. The DP related consumers are listed in the table below: 440V Swbd PS Emergency provision to feed ESB 440V if failure MSB 440V SB with temporary cable HVAC CP AC2: Supply fan ER PS Supply/exhaust fan ER PS (backup supply from ESB) 440V Swbd SB Cooling water pre heating unit SB
4.20.2
4.20.3
PDP1 (Non DP critical consumers)
| 34
Chiller water unit 2 GPS 1 WS-PDP 1: Taut Wire electrical cabinet HVAC CP AC3: Supply fan BT room HVAC CP AC1 CP ventilation: Supply fan azimuth thr. room Supply fan HiPAP room
PDP 4 (Non DP critical consumers) PDP 3 (Non DP critical consumers) Trafo 2 440/230V NSB WS-PDP 2 (Non DP critical consumers) HVAC CP AC 1 (back-up) HVAC CP Mech Ventilation: AC Chiller pump No.1 AC Chiller pump No.1 Supply fan ER SB Exhaust fan BT room Supply/exhaust fan ER SB (Back up supply from 440V ESB) Supply/exhaust azimuth thr room (Back up supply from 440V ESB) Fan No. 1 cooling unit ECR (Back up supply from 440V ESB) Fan No. 2 cooling unit ECR (Back up supply from 440V ESB) AC compressor chiller water unit 3 AC compressor chiller water unit 1 GSP 2 Emergency switchboard
Service air compressor Reefer PDP 2 (Non DP critical consumers) Cooling water pre heating PS PDP 2: Cathodic protection impressed current ICCP Propulsion converter port (auxiliary supply) Compressor Intering (GA7-FF-GS) PDP 1 Trafo 1 440/230V MSB 230V
Table 4-9: 440V MSB Consumers
4.21
4.21.1
440V Distribution Failure Modes

The consumers of each side of these two switchboard sections are primarily related to the port side or starboard side as appropriate. Exceptions occur for the air conditioning units and the third pump where a common stand-by is available for both port and starboard sides. The three seaw a t e r pumps are cross-connected with manual valves in between. This arrangement is satisfactory provided the common stand-by is used when DP is not required (for example) so that the running hours and planned maintenance can function and leave the port and starboard units available for important DP operations. AC1 is only for the Wheelhouse and the Bridge Void as the ECR has its own AC-unit.
| 35
4.21.2
The engine room is supplied by two, two speed fans. In normal operation, they are run at slow speed. In the event of failure of one, the speed of the remaining fan is increased to high speed, which has been proven to provide ample air for the engines. Failure of one side of the 440V board will also fail half the ventilation to the engine room, the azimuth thruster room and the bow thruster rooms. If the engines are still running then a temperature, rise may occur but the rise will be slow and there will be enough time to cease the work and reach a safe situation. The air conditioning systems critical to DP function, are located on the bridge and ECR. The air-handling units for these systems are cooled by the three chiller plants located in the ER. Any one of the three chiller plants can be used for the bridge or ECR AC systems. Both units are fitted with spare fan motors and if the control system fails, manual operation of the control valves is possible. Disintegration of the fan would be a problem until it was replaced. To keep working a portable fan could be employed otherwise the work could be terminated until the repairs were made. There should always be time to safely terminate the work. The particular failure mode that has been experienced on similar vessels is loss of AC followed by condensation on cold surfaces of the DP control systems and subsequent failure. Failure of the AC is alarmed and the motors for the system are supplied from both switchboards. On failure of the port 440V switchboard, the AC1 air handling motors can be switched over to be powered by the starboard switchboard but there would then be inadequate power to continue to run AC2 and AC3. The cooling unit in the ECR is powered from the starboard board normally so that would continue. Should the starboard 440V switchboard fail the cooling unit in the ECR can be switched over to the Emergency Switchboard. However, as this is normally supplied by the starboard main switchboard it will rely on the Emergency Diesel G enerator starting and running to remain operational. AC2 and AC3 units will fail anyway in this case because they are powered from this switchboard. These units supply the main deck and accommodation.
4.21.3
4.21.4
4.21.5
4.22
4.22.1
440V Emergency Switchboard

The emergency generator is independent and supplies the emergency 440V switchboard when the normal supply from the starboard 440V board fails or is unavailable. The 440V emergency switchboard supplies the following consumers:
440V Emergency swbd HVAC CP AC 2 (Back up supply) GSP 1 (Emergency supply): Pre LO pump No. 1 (back up supply from ESB) LO starter thruster port (back up supply from ESB)
| 36
FO booster pump No. 1 (back up supply from ESB)
GSP 2 (Emergency supply): Pre LO pump No. 4 (back up supply from ESB) LO starter thruster SB (back up supply from ESB) FO booster pump No. 4 (back up supply from ESB)
Trafo 230V EPDP1: Propulsion converter SB (Auxiliary supply) HiPAP system hoist control unit
HVAC CP MECH VENT (Back up supply) Steering pump SB 1 Steering pump SB 2 Em. Fire pump Bilge Ballast pump MSB 1 24V Battery Charger Bridge Void alternative supply MSB 2 24V Battery Charger ER preferred supply
Table 4-10: 440V ESB Consumers
4.23
4.23.1 4.23.2 4.23.3
440V Emergency Switchboard Failure Modes

The primary effect of loss of the 440V ac emergency switchboard will be the loss of the starboard azimuth thruster due to the loss of the auxiliary power supply. The secondary effect of a loss of this switchboard will be the loss of the supply to the 230V emergency switchboard which is discussed in 4.6. The emergency 440V switchboard has a primary supply from the 440V stbd switchboard and the secondary supply from the emergency generator which starts and connects automatically in the event of black-out.
| 37
4.24
4.24.1
230V Switchboards
There are two 230V switchboards supplied by the main 440V switchboard, MSB 230V on the port side and NSB 230V on the stbd side. In the event of failure of the stbd switchboard, the NSB can be supplied from MSB 230V by manual changeover. The MSB 230V supplies two further significant 230V distribution boards ENSB PS and ENSB SB. These supplies automatically change to ESB 230V if power is lost on the port switchboard. In principle, the consumers are split in line with the port and starboard separation for engines, thrusters and DP in general. The distribution panels of interest are listed below: 230V MSB NLDP 3: HVAC CP AC 3 - 230V section Bow thr fwd electronic cabinet (main supply) Bow thr aft electronic cabinet (main supply) AC heating bow thr aft NLDP 4: ECR console (additional power supply) MSB 690V AC heating MSB 440V AC heating GSP 2 AC heating PRAXIS AMCS Client (ECR_UPS) DPU 2 cabinet light and fan Cathodic protection 690V/440V transformer No.1 AC heating 690V/440V transformer No.2 AC heating NLDP 5: AC heating azimuth thruster PS AC heating azimuth thruster SB Ventilation control panel Propulsion converter PS (Heater supply) Propulsion converter SB (Heater supply) WS-PDP 2 SDP 230V via Transformer ENSB 230V PS (Main supply) ENSB 230V SB (Main supply)
Table 4-11: 230V MSB Consumers
4.24.2
4.24.3
| 38
4.24.4 4.24.5
The gyros and the forward and aft bow thrusters electronic cabinets have also 24Vdc backup power supply. The distributions ENSB PS and ENSB SP can be powered from the 230V port switchboard or from the 230V emergency switchboard (changeover).
ENSB 230V PS NDP 1 (DP console PS) Fire detection panel Gyro repeater 851 E018 DP Console PS DP JC-11 single controller joystick DP UPS No. 1 Anemometer PS aft display
ENSB 230V SB NDP 2 (DP Console SB) NDP 4 (Docking console SB) NDP 6 (Aft centre console) DP UPS No. 2 Gyro No. 3 Gyro repeater 851 E025 DP console SB Anemometer SB aft display
Table 4-12: ENSB PS and SB Consumers
4.24.6
The NSB 230V distribution is powered from the starboard 440V via transformer and can also be powered from MSB 230V in the event of NSB transformer failure. The consumers of the NSB 230V distribution are listed in the table below:
NSB 230V NLDP1:
VHF Radio charger (Bridge) PRAXIS AMCS Client 2 (Bridge)
NLDP2: Telephone exchange HVAC CP AC 2 (230V section) HVAC CP Mech ventilation (Heater supply) AC heating MSB 690V AC heating ESB 440V AC heating GSP 1
WS-PDP1
Table 4-13: 230V NSB Consumers
| 39
4.25
4.25.1 4.25.2
230V Distribution Failure Modes

Loss of any 230V distribution panel will have no immediate effect on DP as most of the DP related consumers have other power supply available. The DP UPS can run on batteries for a minimum of 30 minutes and the gyros have 24Vdc back up power supply.
4.26
4.26.1
230V Emergency Switchboard

The emergency 230V board is supplied from the emergency 440V via transformer and supplies the following consumers: 230V Emergency Switchboard Supply from 70kVA transformer Emerg. Gen. Room ENSB 230V PS (In the event of the loss of the MSB 230V the supply will automatically change over to ESB 230V): ELDP5 NDP 1 (DP console PS) Fire detection panel Gyro repeater 851 E018 DP Console PS DP JC-11 single controller joystick DP UPS No. 1 Anemometer PS aft display
ELDP1: Fire dampers (AC1 AHU fire dampers) HVAC CP AC1 - 230V section
ELDP2: Fire dampers (AC2 AHU) Fire dampers (AC2 ventilation fans)
ELDP3: Fire dampers (AC3 AHU) Fire dampers AC3 ventilation fans
ELDP4: DPU 1 cabinet light and fan Valve control fuel system Service air receiver Starting air drier DP warning system traffic lights
| 40
ENSB 230V SB (In the event of the loss of the MSB 230V the supply will automatically change over to ESB 230V): NDP 2 (DP Console SB) NDP 4 (Docking console SB) NDP 6 (Aft centre console) DP UPS No. 2 Gyro No. 3 Gyro repeater 851 E025 DP console SB Anemometer SB aft display
Battery Charger PA System UPS A&M

Table 4-14: 230V Emergency Switchboard Consumers
4.27
230V Emergency Switchboard failure Modes

Cause(s) 440V/230V transformer 440V ESB power 690/440V transformer short circuit 440V short 230V operator error Effects One JS supply lost. Comment ENSB PS & ENSB SB normally supplied from MSB 220V.
Failure Mode Loss of 230V ESB
Table 4-15: 230V ESB Failure Modes
4.27.1
Several of the critical items of equipment not only have UPS supplies but also have separate 24V back up supplies so if the UPS batteries are found to be inadequate when the charger fails power will not be lost. (See 4.28.3)
4.28
4.28.1
24V Systems
There are two separate 24V DC supply systems, MSB1 located in the bridge void space and MSB2 located in the engine room. These supply two further 24V distribution panels. Both switchboards have a manual changeover switch allowing supply to be taken from either the port or starboard 440V MSB. These switches are clearly marked to avoid the possibility of the two systems being supplied from the same switchboard. The PMS units however are also supplied by local transformer rectifier units from the diesel generator, once it is running, via a 690/230V transformer. This also supplies the Woodward 723 digital controller for the generator. When the generator is not
4.28.2
| 41
running, the system is powered from the 24V board. The board is diode protected from the generator supply. The board is normally powered from the bridge charger rectifier and/or batteries located on the bridge. The charger is powered by the emergency 440V switchboard with a changeover to port.
24V Switchboard MSB1 (bridge)
Supply PDP1 Q1 (normal) ESB 440V
Distribution Panels DP24V (engine room) TLDP1 (bridge void) TLDP2 (O/S Galley) TLDP3 (hold fwd.)
MSB2 (engine room)
GSP1 ESB 440V (normal)
Table 4-16: 24Vdc Distribution Power Supplies and Distribution Panels
4.28.3
There is adequate redundancy in supply but nevertheless a risk of a mistake exists because both systems could be powered from the same switchboard (port or emergency) so that if the switchboard fails it would leave much equipment on batteries. The use of DP checklists prior to commencing operations will ensure that the systems are properly configured. The following is a list of 24V consumers and their associated power supplies:
4.28.4
EQUIPMENT Gyro No. 1 Gyro No. 2 Gyro No. 3 DGPS 3 (C-NAV 3050) DG1 PMS (PS FWD) DG2 PMS (SB FWD) DG3 PMS (PS AFT) DG4 PMS (SB AFT) WECS DG No.1 PORT FWD
SUPPLY 1 MSB1 24V MSB1 24V MSB1 24V MSB1 24V DP24V MSB2 24V DP24V MSB2 24V DP24V
SUPPLY 2 DP UPS No. 1 DP UPS No. 2 ENSB SB
Local when DG Running Local when DG Running Local when DG Running Local when DG Running MSB2 24V
| 42
WECS DG No.2 STBD FWD WECS DG No.3 PORT AFT WECS DG No.4 STBD AFT BT1 Electronic Cabinet BT1 Alarm Unit BT2 Electronic Cabinet BT2 Alarm Unit Azimuth Thruster BCU Master Azimuth Thruster BCU Slave PS Azimuth Thruster ACU SB Azimuth Thruster ACU ECR Azimuth Control Unit AIS Control unit PRAXIS DPU 5 XS318 BRIDGE ECR Console Talkback unit Gyro switchover unit
MSB2 24V DP24V MSB2 24V NLDP3 DP 24V NLDP3 TLDP2 TLDP1
DP24V MSB2 24V DP24V DP 24V
TLDP2
TLDP2 MSB1 24V TLDP3 TLDP2 MSB1 24V MSB1 24V MSB2 24V TLDP1 TLDP1
Table 4-17: 24V DC Consumers
4.29
4.29.1
24Vdc Systems Failure Modes

Failure of power supply to a 24VDC charger rectifiers will result in a changeover to the battery supply. An alarm occurs and the system is supplied from the batteries which are designed to support systems and services for 30 minutes duration. Failure of a 24V DC distribution panel will fail the corresponding consumers, however the majority of the consumers related to DP have other power supply available and no loss of thrusters will occur.. Loss of MSB 1 24V will result in loss of DGPS3 which has a single power supply.
4.29.2
| 43
4.30
4.30.1 4.30.2
DP UPS
There are two DP UPSs installed on board. The DP UPS 1 is powered from the ENSB PS and the DP UPS No. 2 is powered from the ENSB SB. The consumers of each DP UPS are listed in the table below: DP UPS No. 1 DPC 21 A DP OS No.1 Fanbeam supply DGPS 1 - VERIPOS system DP alarm printer socket (Isolated) Gyro No. 1 Taut Wire control Anemometer PS fwd display and NMEA buffer (DP wind 2) DPC 21 B DP OS No.2 DP Hard copy printer socket (Isolated) APC 10 - HIPAP PC DP OS No.3 HiPAP transducer Gyro No. 2 Anemometer SB fwd display and NMEA buffer (DP wind 1) MRU No. 2 (MRU5)
Table 4-18: DP UPS Consumers
DP UPS No. 2
4.31
4.31.1
DP UPS Failure Modes

Loss of the output from one UPS will fail the corresponding consumers. The equipment remaining on the other UPS should be sufficient to maintain position depending on operating parameters. Loss of mains input to a UPS will result in the UPS running on battery power and supplying the load for a period in excess of 30 minutes. An alarm on the DP control system alerts the operator to the loss of mains input.
4.31.2
| 44
5.
THRUSTERS
5.1
5.1.1
DP Capability
The generator capacity shows that the stern azimuth thrusters might not be able to work at full power when one side of the power plant fails. This limitation however may have very little impact on the DP capability because the vessel is unlikely to work in weather conditions that require full thrust on one stern azimuth thruster. The DP capability will be controlled by the bow thrusters. If the vessel is working head to weather then the loss of the forward bow thruster will be very limiting. The vessel will have a better DP capability stern on to the weather but this might make the after deck too wet. When the weather is from more than 30 on the bow the power in the thrusters aft cannot be used. However, significant project equipment on the after deck is also unlikely to reduce DP capability significantly.
5.2
5.2.1
Bow Thrusters
The bow thrusters are supplied by Rolls Royce (type TT1660 DPNCP) and are driven by 690V AC motors at 1800 rpm. They are controllable pitch with hydraulic power packs to change the angle of the blades from full starboard to full port in 18 seconds. The propeller speed is 374 rpm and the calculated thrust is 85kN each. They have radial lip seals of the 3-ring type, which enables pressure control, and drain connection/leakage detection, which is very important for thruster management. The seal material is Viton Super lip running on a ceramic-coated stainless steel liner. A rope guard is mounted on the gear housing to protect the seal. The hydraulic power pack comprises a tank, filter, cooler and two pumps; one duty and one stand by with an automatic change over if one fails or if there is low pressure. Loss of pressure will cause loss of control and the drive motor should trip. There is also a gravity tank that provides the positive pressure against the seawater the other side of the propeller seal. This pressure should account for static head at the maximum plus a margin for motion. The filling of the system is important so that air is not trapped in the system and the required system head is maintained.
5.2.2
5.3
5.3.1
Bow Thrusters Failure Modes

One bow thruster can fail from a number of causes as shown below but the effect should always be acceptable if the vessels capability was not being exceeded. The assessment of the safe working limit will always be for the operator to decide because the consequence analysis warning may well come several minutes after the limit has been exceeded. The normal feature of DP control systems for mono-hulled vessels is for the bow thrusters to be used together and for high levels of pitch to be used for short periods to counter the effect waves have on heading. This feature called heading priority is very necessary so heading is not lost say 10 and is then not recoverable
THRUSTERS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 45
because of the sequence of waters experienced. Therefore, the thrust demands of the two bow thrusters could be at 100% for brief and isolated periods and at 20-30% otherwise. In these circumstances, it is difficult to assess whether it is safe to continue operations, however normal DP practice would be to alter the heading to reduce thruster demand or consider stopping DP operations when the thrust demand from the bow thrusters exceeds 80% for more than brief or isolated periods. Failure Mode Loss of one BT Cause(s) Electrical fault Hydraulic fault Overcurrent (motor) Low oil pressure Wire rope in tunnel Mechanical damage Control fault Feedback fault Valve stick Control fault Control fault - pot - amp - earth Effects Stop Comment Other BT
Bow thruster to full pitch Unstable pitch
Operator must stop if no overcurrent Degraded performance
Critical to DP
Difficult to detect
Table 5-1: Tunnel Thruster Failure Modes
5.3.2
The worst failure mode is failure to full pitch especially if this happens on the forward of the two bow thrusters because all the thrust of the after unit will be consumed to counter the turning moment unsuccessfully. The causes are electronic, mechanical or hydraulic. Some vessels use two feedback potentiometers and freeze pitch if there is a difference. Pitch can also be frozen if the pitch movement does not follow as expected but there is always a delay in such checks and it is better to have no thrust than unwanted thrust. In a 1 + 1 DG arrangement, one bow thruster moving to full power risks overload to the one diesel generator unless reduction can be made on the stern azimuth thruster fast enough. This may release enough power to trip the bow thruster on overcurrent. However, the remaining healthy bow thruster will then be at full pitch to recover the loss in heading. If the feedback linkage breaks or a hydraulic valve sticks that, the resultant full pitch will cause overcurrent and the tripping of the drive motor. This is satisfactory. If the pitch freezes and the alarm is given on the DP, the operator should stop the thruster motor completely and not just deselect it from DP. This is because the thruster, even though deselected from the DP, continues to run, resulting in loss of heading even when the command signal is zero Unstable pitch can occur from worn parts or maladjusted potentiometers. Similarly, poor adjustment of the zero pitch can make starting currents much higher. The start system is interlocked so that two generators must be running and fans running on high
5.3.3
5.3.4
5.3.5
| 46
speed before the bowthruster can be started. As mentioned previously, the DP capability is not degraded much (in practical working terms) from the loss of one azimuth thruster but is from the loss of one bow thruster.
5.4
5.4.1
Azimuth Thrusters
The stern thrusters are not CPP but fixed pitch with variable speed frequency drives. The propeller and azimuth controls are supplied by Rolls Royce, as are the bridge and engine room panels. Two electric-driven steering motors (independently fan-cooled) provide azimuth control. The steering motors serve to rotate the azimuth thruster to the required heading. Failure of the feedback signals can be detected and alarmed before serious misalignment takes place however, a misalignment of up to 45deg is possible which causes a position excursion until the thruster is stopped or the error is compensated for by the integral term of the DP controller. There is only one feedback to the DP control system and a separate feedback to the Aquamaster control unit. The feedbacks are sin and cos. The azimuth thrusters can be used for steering (auto track and autopilot) either together or individually. When in DP there should be restricted zones so that they are efficient and do not interface with each other. Maladjustment of these zones can cause position instability particularly in rough weather. The DP control system will generally always rotate these thrusters to use ahead thrust but when a rapid change of thrust direction is needed, they may rotate astern. The logic used was tested on trials to show that it is optimised for DP and crash stops and found to be satisfactory.
5.4.2
5.5
5.5.1
Azimuth Thrusters Failure Modes

Failure of one azimuth thruster when on DP is not critical. There are alarms for all the parameters of interest like water temperature for the water/water heat exchangers (from the vessels fresh water cooling system) and water leakage within the converter cooling system and water flow and pressure. There are indications and alarms for winding temperatures, motor current, power and control system faults. However, the items that are important to DP control are those used for control because it is essential that unwanted thrust is not developed. The speed demand from the DP (or RR panel) is sent to the azimuth thruster converters PLC, which executes the command and receives the feedback from the motor from the incremental pulse tacho. It is essential that this feedback does not fail or give incorrect data as unwanted thrust and/or a position excursion could occur. The other failure mode that is potentially critical is the power limitation to prevent blackout should a diesel generator trip for example. The PMS has serial communications with the drive converter PLC but the critical speed signal is hardwired and there is an analogue back up. When power limitation is calculated to be necessary (true or false diesel generator trip signal) a single contact opens and the output power of the thruster drive is reduced to 100kW for 3 seconds irrespective of speed.
5.5.2
5.5.3
| 47
Failure Mode Drive motor trip
Converter trip
Speed control fault Lube oil pump fail Electrical fault Mechanical fault Azimuth motor Electrical fault fail Mechanical fault Azimuth Wire break feedback fault Unwanted power Wire break drop Loss of control Leak or reducer air fault Power Limitation Hardware or too software late fault
Cause(s) Mechanical fault Electrical fault Lack of cooling Mechanical fault Electrical fault Lack of cooling Wire break
Effects
Reduced DP capability
Comment
Reduced DP capability
Unwanted thrust Alarm only Reduction rotation speed Thrust in unwanted direction Small position excursion Possible reduced seal pressure Blackout one 690V board
Small position excursion if stopped quickly
Azimuth feedback difference alarm Alarm and operator can decide Alarm and operator can decide No immediate effect Small position excursion if safe Limits not exceeded
Table 5-2: Azimuth Thruster Failure Modes
5.5.4
The azimuth thrusters have several control locations. They each have local controls, there is a control board in the engine control room plus aquapilot control panels and there are control units, interface units and three control lever panels on the bridge plus the DP and autopilot. The independence of these units was verified on trials, confirming that when in DP none of them should be active and no single fault or act of maloperation should make them so. The interpretation of the latter point has to be reasonable. This means that maloperation has to be a mistake rather than an action to cause a problem deliberately and this is unlikely, as the permit to work system does not allow any work to be undertaken on critical systems during DP operations. Simple faults can include wire break, shorts and earth faults.
5.6
5.6.1
Thrusters Emergency Stops

The thruster emergency stops are located on each control panel and are connected directly to the main drive motor starters. They are independent of the control system and will shut down the main motor. The emergency stops circuits are NC circuit. In case of a wire break / open circuit in a thruster emergency stop the thruster will stop. The thrusters emergency stops are within reach of the DP Operator and protected against accidental activation.
5.6.2
| 48
6.
DP CONTROL SYSTEMS
6.1
6.1.1
DP21 Computers
There are two independent but linked microprocessors (Single Board Computer SBC based on Intel 960 RISC processor) which take the input data received from a range of sensors using a master/slave relationship and generate the signals to the thrusters required for position and heading control. The system for the console computers is a Windows TM NT 32-bit operating system but this is just used for display purposes. The actual control is executed by the computers (SBCs) in the Kongsberg computer cabinet located in the void space beneath the bridge. The two (DPC) computers operate in parallel each individually receiving input from sensors, reference systems, thrusters and the operator and performing the necessary calculations. However, only the on-line computer (master) controls the thrusters. Switchover between the computers (master/slave) may be either automatic or manual. It is automatic if failure is detected in the on-line computer. Continuous comparison tests are performed to check that the two computers read the same inputs and give the same outputs. If a difference occurs, warnings and alarms are reported from each computer. The weak point in a dual redundant system is the ability to determine which computer is wrong. The operator therefore could choose the wrong one. In practice, this difference is rare. To meet DP Equipment class 2 at least three position references must be available, whereby the system can exclude a failed or degraded position reference and still keep position. This vessel is configured with four different position references i.e. DGPS, HPR (Simrad HiPAP), a taut wire and an MDL Fan Beam. During the DP trials, the fan beam was not available, but it had been commissioned earlier during customer acceptance trials. It will only be hired on a project basis. The Consequence Analysis warning does not take position references or sensors into account but reacts purely on low power availability or insufficient thrust (thrusters and generators). Both computers and all interface boards are located in the upper cabinet whereas power supplies are sited in the lower cabinet. Although the CPUs and the power supplies are separated, the interface boards are serial linked with both computers connected to each board. There are analogue boards for the thruster, MRU signals and digital boards for other data. There are two separate cards, one to handle all inputs and one to handle all outputs. Each will have galvanic isolation so no single fault can degrade more than one system. Two internal Power Supply Units (PSUs) are mounted to the computer cabinet. Their function is to generate a stable reference voltage for the potentiometers used for the feedback signals. A redundant Ethernet is installed between both computers and the operator stations. In case network A fails, B will take over and vice versa. However, each has the same data and same software so if the on-line net is overloaded so too will be the backup. It is important that this cannot happen.
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
DP CONTROL SYSTEMS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 49
6.1.7
The SDP system has only very basic features for hardware error detection of the interface and the network hardware. The operator has to be extremely experienced in order to identify the problem when an error occurs and take the necessary corrective actions in time. To take command of the thruster in DP a changeo ver switch is located on the forward bridge. It is directly hardwired to each thruster controller and a single failure of the switch should not be able to disconnect more than one thruster from DP.
6.1.8
6.2
Operator Consoles
Courtesy: Kongsberg Simrad 6.2.1 Three operator stations (OS) with similar consoles are installed on the bridge and they all have the same functionality including a joystick. OS1 is located on the bridge forward midships, while the other units are located on the bridge aft, to port and starboard. The 230V power supply to the consoles OS #1 and OS #2 comes from UPS 1 and UPS 2 respectively. Each OS is also supplied with 24V. The 24V is fed from the 230V via a 230V /24V converter. The screen of each console is divided into one large area on the right and two smaller areas on the left and the size of these areas cannot be changed. Each of the areas can display a separate page of information, which can be selected by the operator. Alarms are displayed when the Alarm button on the keypad is pushed. All the alarms are presented on an overlapping window on the screen of the console where the button is pushed. When an operator has to input information this is also done using overlapping windows, which always show up at the same location on the screen. The cursor is positioned directly on the input window. The pointer can be moved using a trackball and selections are made using one of the three buttons in front of the trackball. Colours can be selected from t w o palettes (e.g. Daylight and Night). The Night palette has different colours and easy to split information and commands can also
6.2.2
6.2.3
6.2.4
| 50
be made using the push buttons but they all look alike. No colours are used to distinguish functions but they do have text and when a button is pushed an indicator light will illuminate showing the function has been selected. Critical buttons are double push non-critical buttons are single push. Therefore, surge, sway and yaw for example are double push.
6.3
DP Control Modes Functions
Courtesy: Kongsberg Simrad 6.3.1 The standard DP control modes are implemented which are standby, manual (joystick) and auto position. Mixed modes between manual and auto give automatic control of heading, X-axis and Y-axis either separately or combined. When all three are selected an automatic switch to auto mode is made. The system has in addition High Precision Control, Relaxed Control and Green Control. In principle, these modes are promoted to reduce thruster wear and use less fuel. Generally, operators experiment with modes and gains and then use only a few combinations. Other modes include Auto track (low speed & high speed) and fixed and variable azimuth mode. The wind, gyro and VRS/MRU sensors used by the DP system cannot be directly selected from the keypad. Instead, a dialogue box on the screen is used where the sensors have to be enabled and the preferred sensor has to be selected. On the keypad, a button only controls whether the gyro, VRS/MRU and wind inputs are made available to the DP control system. The management of position references is of primary importance because the DP control system acts immediately on position error and, for good position performance, needs new data at one-second intervals. Clearly, there is a need to: filter noise determine the relative weight of each correct for vessel motion (roll and pitch) 6.3.5 To help the above process a Kalman Filter uses the mathematical model of the vessel to predict the position excursions of the vessel that are reasonably possible in the conditions sensed over the last 10 or 20 minutes. It is self-adaptive so reducing the noise of the position (and heading) inputs. It can increase reliance on
6.3.2
6.3.3
6.3.4
| 51
the model when the position references are poor. It can also provide dead reckoning when there are no position references accepted and calibrated t hu s providing a fill-in while another position reference is made available. It is essential that the tuning of the Kalman filter is correct so that it improves performance in all conditions not just some environmental conditions. It is most useful when the conditions are marginal and these conditions are really needed for the trials. 6.3.6 DP consequence analysis must be selected when undertaking DP 2 work. The analysis provides a warning to the DPO. Checklists should be used to ensure the analysis is running when undertaking DP critical work. The analysis however should not be relied upon because it takes three consecutive calculations over three minutes all to say failed before a warning is given. So safe working limits can be exceeded for some time, even 15 minutes before the operator is warned; a good operator is therefore better than this analysis. The facility works well when there is a steady increase of environmental load from current. It does not work well in squalls.
6.4
6.4.1
IJS System
An independent joystick (IJS), is situated on the Bridge. The IJS utilizes a totally independent hardwired interface to each individual. The IJS is therefore considered as the last resort should there be a total network failure. The IJS controller is powered from the 230V ENSB PS.
6.4.2
6.5
6.5.1
Motion Sensors
There are two motion sensors of the type Seatex on board, one MRU-H (MRU1) and one MRU-5 (MRU2). Both MRUs are used as sensors to the SDP. MRU 2 is also directly used for the HiPAP and connected to the MBES (EM3000). MRU1 is connected to the EA600 echosounder and can be connected to the HiPap if MRU 2 fails. The MRU system uses solid-state device to measure the roll, pitch and heave rate. Integrating these signals gives the roll, pitch and heave measurements. The MRUs are powered from the DP system. MRU1 is supplied from the DPC and MRU2 is supplied from UPS2. The MRU data is fed as 10V dc signals. Loss of these signals from these inputs will cause an alarm in the DP consoles once failure is detected but this is difficult if there is little motion and the vessel is not inclined.
6.5.2
6.6
6.6.1
MRU Failure Modes

When the measured antenna or transponder position is corrected erroneously with wrong inclination data, the DP system will react and degrade the station keeping. A slow drift of the input is dangerous because it will not be immediately detected. When the difference between the two units exceeds a pre-set limit (1deg), an alarm is given and it is up to the operator which VRS to select as input to the DP system.
| 52
6.6.2
The HPR default setting is MRU 2 so if this unit has a fault so does the position data from the HPR. If MRU 2 is also selected as preferred then all position references will have a fault: the effect of this is a degraded position performance at best and a drive off position at worse. However, there is a way of switching over to MRU 1 in the software by means of manual selection. It is still advisable the Checklist should make MRU1 preferred so that the DGPS and Fanbeam (when fitted) are corrected by a different MRU (MRU1) to HPR (MRU2).
6.7
6.7.1
Gyro Compasses
The vessel is equipped with three gyros; all three are the same type (Navigat X MK1, Mod 10-4914). The gyros are located in the void space beneath the bridge. All of the gyros are interfaced to the SDP 21 and the operator must select the preferred gyro. No.1 gyro is used by the HPR. In this case, another gyro must be selected as preferred because the fan beam and DGPS may not be given a unique gyro input and will provide relative fixes to the DP control system.
6.8
6.8.1
Gyros Failure Modes

The gyros are treated in a similar way to the position references but because they are the same their characteristics will be similar and the identification of a rogue gyro more easy. The chances of a common fault failing all three gyros is negligible: they all have separate power supplies. The difference alarm should be set at 2 deg. The output from these gyros is also quite secure (serial line NMEA-0183) and loss of this connection is immediately alarmed. Only the slow drifting of the preferred gyro when only two are available presents a DP hazard but the vessel is no longer DP2 in this condition. Single point gyro failures can occur due to corrupt latitude and speed correction data from DGPS. It is imperative that these corrections are set to manual during DP Operations.
6.8.2
6.8.3
6.9
6.9.1
Wind Sensors
The vessel is equipped with two analogue wind sensors, both manufactured by RM Young. Both wind sensors measure the wind speed and direction, which is used in the DP mathematical model to calculate the thrust needed to balance this force. This is added to the thruster allocation logic immediately to compensate for the calculated wind force (wind feed forward). Both wind sensors are placed on the navigation mast (forward & aft positions) above the main bridge. Both units are supplied from UPSs (wind sensor 1 UPS2 F8 and wind sensor 2 UPS1 F9) and both should be enabled whenever possible.
6.9.2
| 53
6.10
6.10.1
Wind Sensors Failure Modes

When both units are enabled difference, alarms are generated for wind speed and direction to alert the operator of a mismatch. This feature can be a nuisance at times but it is better than having just one selected because a failure in speed or direction can cause a position excursion and degrade the DP mathematical model. Complete loss of the wind speed signal (RM Young wind sensors) when there is some wind, > 5 knots will cause an alarm. However, loss of the direction feedback can cause an acceptable (to the DP) shift and a sudden unwanted increase in thrust.
6.10.2
6.11
6.11.1
Hydro Acoustic Position Reference (HPR)

The HPR system is named HiPAP (High Precision Acoustic Positioning) and is designed for water depths from very shallow to deep-water (2000m) looking straight down with a standard unit. The transducer extends below the hull through a gate valve and comprises a semi-spherical transducer with over 220 elements. Electronic controls nearby within the vessel enable beam directional transmission and focused reception in the direction of the transponder, thus improving the signal to noise ratio. This is important because the base line is very short (only the distance of the head itself). The system calculates the subsea position of a transponder relative to the vessel mounted transducer unit. The directional stability of the unit is obtained by firstly fixing the transponder location by a wide beam and subsequently narrowing the reception beam towards the transponder. The system uses a digital beam form, which takes its input from all the transducer elements. The system controls the beam dynamically so it is always pointing towards the target, roll, pitch and yaw is input to the tracking algorithm to direct the beam in the correct direction thus enabling the correction for these motions to be effectively applied continuously. The system calculates a variance for its measurements, determines the system accuracy and standard deviation. The HiPAP has a built-in Kalman filter, which improves the stability and accuracy of the initial narrow beam optimisation but does not interfere with raw data being sent to the DP control computers. Raw data should be used because filtering causes a lag, which can cause instability. The transducer is directly hardwired to the HiPAP OS. The system is supplied 230V from UPS-2 and the transducer hoist system is powered by 440V AC from EDDP1 for safe recovery in blackout scenarios and is supported by emergency generator changeover. The performance of HiPAP is also dependent on the gyrocompass and the MRU. This is a weak point, as the reference is dependent on both the MRU and gyro. The HiPAP is, however, a single reference in a vessel with four position references and a backup DGPS.
6.11.2
6.11.3
6.11.4
6.11.5
| 54
6.12
6.12.1
HPR Failure Modes

There are many failure modes of this system but the majority are detectable either by the system itself or by the DP control system. Failure Modes that are a risk because they are not detected are: reduced performance (failure of some of the heads) lost transponder(s) dragged transponders when tethered on wire or rope loss of signal and/or refraction noise from thrusters and/or other vessels.
6.12.2
The performance was bench marked on trials so that an initial value was established and can be verified several times on an opportunity basis so that any reduction in performance can be quantified. All vessels approaching should be warned if acoustics are being used. They should switch off echo sounders if they operate close to the frequency being used by deployed transponders. Noise interference is also a problem when working in heavy weather; noise turbulence and vibrations will cause occasional signal loss. The extent to which this is a problem will depend on the machinery noise and current. If operating with only DGPS and acoustics, failure of the DGPS can cause increased thruster activity that in turn causes loss of the acoustics and a loss of position to take place. Transponder battery failure can also be experienced at any moment. If only one transponder is deployed, a single failure will disable the HiPAP. Again, on this class of vessel, this failure is not dramatic assuming good quality satellite reference and fan beam data are available. A log of transponder battery use should be carefully kept. Online help is provided within the HiPAP software and the Operator can access this valuable feature whilst in operation. The help format follows similarly from that provided in the SDP software, being indexed alphabetically or in groups. Help for both HiPAP and SDP follows the Microsoft Windows conventional interface and is simple to operate.
6.12.3
6.12.4
6.12.5
6.12.6
6.13
6.13.1
DGPS
The vessel is fitted with four DGPS, three of which are dedicated for DP use only. DP DGPS No.1 is a Subsea 7 Veripos system receiving differential corrections simultaneously from Spotbeam and Inmarsat communications satellite. DP DGPS No.2 is a Litton MX420/8 receiving differential corrections from coastal MF stations. DP DGPS No.3 is a C-NAV 3050 receiving differential corrections from Spotbeam. All these three DGPS are interfaced with SDP21 system using NMEA-0183 serial line. The fourth DGPS is a Litton LMX420/AIS and is used for navigation systems and not connected to the DP. The Global Positioning System (GPS) is a highly accurate, satellite based navigational system, which permits a land based object to fix its geographic position using Doppler phase shift techniques. In order for the Earth station to calculate the fix position, a
6.13.2
| 55
minimum of four transmitting satellites (above its radio horizon) is required. The DP system is set to reject the DGPS if less than five satellites are available. 6.13.3 By calculating the naturally occurring error at a known location, it is possible to obtain a differential correction figure, which can be applied to mobile offshore stations using the GPS system. This technique, known as Differential GPS (DGPS), enables the precise fixing of a vessels position with sufficient frequency for it to be used as a position reference for DP operations. This technique improves the position accuracy of the GPS system to within metre accuracy. The antennas for the GPS system and the differential corrections are distributed to different locations on the wheelhouse roof. The difference in antenna locations is to ensure that they will operate with different satellite constellations. The DP operator will need to ensure that they operate with different correction signals. The differential signals should be input into the DGPS from two different sources.
6.13.4
6.14
6.14.1
DGPS Failure Modes

Possible failure modes for the DGPS are: GPS signals blocked by structure Reception of reflected signals causing range jump Reflected signals may combine with direct signals and cause fading or signal loss Loss of correction signal.
6.14.2
The performance was bench marked on trials and it was confirmed that no shadow areas existed. When the vessel is operating within the 500m zone of a large installation this will need to be verified.
6.15
6.15.1
Fan Beam
The vessel has an interface for an MDL fan beam. A Fanbeam Mk4 was fitted and commissioned in Nov 2012 for a new vessel contract and is a temporary additional relative reference system. The Fanbeam is a laser based position reference system, which can input the vessels relative position from a fixed structure, into the DP system, to be used in conjunction with other position reference systems. This system is fed directly from 230VAC UPS 2 (PDU 2). The system uses the principle of laser range finding by measuring the time taken for a pulse of laser light to travel from the laser source to a target and back to the detector. The requirement to have an accurately pointed laser transmitted from a moving platform to a stationary target is achieved by using special laser optics, which transmits a laser beam in a 20 vertical fan. By scanning this fan horizontally, the target can be accurately tracked and have its bearing relative to the vessels heading and range determined. This information is then inputted into the DP system.
6.15.2
| 56
6.15.3
A pulse generator drives the infrared semiconductor laser diode at a rate of 7500Hz to produce the 20 laser fan. These light impulses are adjusted for the line of sight and emitted by the transmitting lens to produce a vertically diverging and horizontally parallel beam. The reflected beam is picked up by the receiving lens and converted to an electrical signal by a photo diode. The time interval measured between the transmitting and receiving of the beam is used to compute the range. The accuracy of the horizontal angle is achieved by detecting every echo from the laser and reading the echo for each echo. Once the laser has passed over the target, the angles are averaged, providing an angle to the centre of the target. Therefore, accuracy is not dependant on target size. The echo signals are averaged to increase the range accuracy. To achieve a range accuracy of +/-20cm at least five echoes are required from the target. The scanner is mounted on a rotating table which is driven by a stepper motor and a precision worm and wheel that results in a resolution of 0.01. A high accuracy optical encoder mounted directly on the laser shaft measures the angular position of the laser. The scan speed is automatically controlled by the system software according to the target range with parameters seen in the table below: Target range (m) <100 100>250 250>500 Fanbeam Speed ( /sec) 50 30 15
Figure 6-1: Fanbeam Scan Speed
6.15.4
6.15.5
6.15.6
6.15.7 6.15.8
The Fanbeam is only effective as a position reference system within approx. 250 metres range of the target. The equipment configuration can be seen below.
Figure 6-2 - Fanbeam Configuration
| 57
6.15.9
The scanner is located in such a position that it allows a clear line of sight in all directions where the targets are to be installed.
6.15.10 The scanner head can rotate through 360 and has vertical adjustment of +/- 15 in 5 steps, which allows for large variations between the height of the vessel and target. 6.15.11 The quality and type of material used for reflectors are critical to the reliable operation of the Fanbeam. Good quality reflective tape can be used on a cylindrical mounting of no less than 150mm and no more than 250mm diameter and 100mm in length. This will give a good target up to 150m, (depending on conditions). Retro Prism will give good accuracy between 150 and 1000metres, (depending on conditions), as they can reflect the laser beam +/- 30 from the prism centre line. For accuracy between 1000 and 2000m, a stack of six prisms is required. 6.15.12 It is essential that the targets are mounted in areas that are clear of obstructions and away from lights and other surfaces containing reflective material, (e.g. life rafts or lifeboats). They should also not be located close to walkways where reflective strips on coveralls or jackets may cause confusion regarding which target the Fanbeam is tracking. 6.15.13 The system is interfaced to the SDP-21 via the universal control unit (UCU); the data is also displayed on a monitor. The target is passive, consisting of a simple reflective item installed on a nearby installation. 6.15.14 Disadvantages are inoperability in bright sunshine or with heavy rain and fog, bright lights near the target or other reflective items. Power loss will require resetting of the system. The assembly has to be installed in a protected location as rain and salt spray might obscure the lenses and affect the operations (see IMCA report M 131, Review of the use of the Fanbeam laser system for dynamic positioning). As the maximum range of the system is, 2000 meters it can be used only when operating near an installation.
6.16
6.16.1
Failure modes of the Fanbeam

The possible failure modes of the Fanbeam are: Signals can be blocked by dirty transmitting, receiving lenses or physical obstacle. The acquisition of false targets, e.g. reflective tape on working gear, lifeboats etc. Signals can be distorted by a low rising or setting sun. Inclement weather, e.g. heavy rain, snow or fog can reduce system efficiency. Frozen range or bearing. Jump in range or bearing. Intermittent signal. Loss of power supply. Loss of serial line to DP control system or Fanbeam processor failure. Loss of encoder feedback. Seizure or malfunction of scanner head.
6.16.2
Signal blocking will not occur due to a dirty lens provided the Fanbeam recommendations for regular cleaning are followed. Signal blocking by other means must be avoided by careful placement of the reflector and following operational
| 58
procedures. However if blocking occurs, the Fanbeam will be rejected by the DP control system and an alarm given. 6.16.3 Intermittent signal blocking might occur during heavy precipitation or fog. This would affect the DP if there is not a clear failure, however, the Fanbeams range checks will detect this and reject the target. Also the target can be lost if it is obscured by dust, fog or smoke. Fanbeams have been known to lock onto false targets such as reflective jackets, etc. on personnel. The DP control systems median check will reject a false target, as it will cause the Fanbeam to diverge from the other reference systems. Low sun or bright lights can affect the Fanbeam; their effects though will be noticed by the level checks of the Fanbeam and the target rejected. Alongside a platform, low sun is unlikely to be a problem as the target will be masked from the sun by the platform and the vessel. Bright lights on the platform could present a problem and the operator will be aware of this. Loss of power to the Fanbeam, loss of the serial line to DP control system or Fanbeam processor failure, will result in the DP timing out the Fanbeam, alarming and rejecting it. Loss of control of the scanner will mean that the target will be lost or at least move outside the Fanbeam window check. It will therefore be rejected by the DP system and alarmed. The Fanbeam can be affected by a number of factors, but as long as it is carefully monitored by the operator, it can provide an invaluable and highly accurate reference. It is very difficult to find an ideal location for the scanner unit, as there are always competing claims for the highest, clearest position. The scanner is likely to have a number of blind spots caused by aerials and the mast itself.
6.16.4
6.16.5
6.16.6 6.16.7
6.16.8
6.17
6.17.1
Taut Wire
The vessel has a Bandak LWTW (light weight taut wire) Mk 14B installed as a position reference for shallow water. This system is an electro-hydraulic-pneumatic system that requires a 440V, three phase power supply and compressed air between 6 and 10 bars. The instrumentation uses a 230V single-phase supply. The taut wire is, as the name suggests a tensioned wire that in this case is held in constant tension by a weight on the seabed and a winch and servo system on the surface. The tension compensating system is pneumatic with air cylinders controlled by a pressure regulator. The length of the wire and the alongships and athwartships angles are measured and used for the calculation of position. Therefore, the position of the seabed weight is the position of the wire suspension point adjusted for by the wire angle and the vessel motion. The position of the vessel is determined from this after allowing for the offsets of the taut wire head position. The taut wire has its own control system (Telemecanique TSX Micro PLC system) and local and remote control panels. The weight should initially be deployed locally but one deployed and the mooring is on operations of re plumbing can be executed from the bridge.
6.17.2
| 59
6.18
6.18.1
Taut Wire Failure Modes

The failure modes of the taut wire are therefore as follows: Drag of the weight from poor tension control or operator error Snagging of the wire/weight by objects / ROV on the seabed Tension too low and poor position data Air failure 440V failure (will prevent recovery only) 230V failure PLC fault Wire against ships hull and no change in position given when position is being lost Broken wire and loss of data Error in one pot meter or broken wire of one No or wrong motion corrections Incorrect wire length (water depth) giving wrong position change data.
6.18.2
All the above failure modes are detectable if three different position references are on line but if only two are in use a drive off is possible from a single taut wire failure. The hardest for the DP control system to detect is the failure or fault in one potentiometer as the position itself will show change but the failure in one axis might be missed and the weighting kept high. Zero change in both pots will cause immediate rejection as will a wire break. The set- up of the taut wire should always give an alarm before the ships side is touched but sometimes this alarm is not adjusted for a list angle.
6.19
6.19.1
Position References a n d Weighting

The vessel is provided with a wide range of position references to provide the operator with various options to ensure accurate tracking of position, regardless of exterior factors. When preparing to operate on DP it is essential, that due regard is taken of factors, which can influence the different systems. The weighting assigned to each sensor within the DP system is determined by the operator. It is essential that three separate systems operating on different principles are employed, such as LTW, DGPS and HPR. In this way, failure of any one system will leave the two remaining units uninterrupted and the system in error will be outvoted. When multiple units of sensor types are available, it is important that they are not given a disproportionate weighting, which could lead to a drive off.
6.19.2
6.19.3
| 60
7.
COMMUNICATIONS
7.1
7.1.1
Bridge
The bridge is fitted with the following shipboard communication systems: Auto telephone Talkback Dive Alert System VHF PA.
7.1.2 7.1.3 7.1.4
The telephone system communicates with the engine room, all offices, cabins and internal work areas of the vessel. The talkback system allows communication from the bridge to the engine control room and thruster rooms. The dive alert system is fitted to the bridge, engine control room and the cabins of the Master, Chief Engineer and Dive Supervisor. In addition, a portable alarm panel, on a 20-metre cable is provided in the Buoy Workshop. The VHF system communicates with the handsets provided to all duty officers. The PA system has four operational zones being: Technical spaces Accomodation Open decks Loudhailer
7.1.5 7.1.6
7.2
7.2.1
DP Alert System
The vessel is fitted with a DP alert system with repeaters in the following locations: Bridge ECR Diving area Captain cabin CE cabin Operational Manager cabin
7.2.2
The DP alert system is powered from the 230V ELDP4.
COMMUNICATIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 61
8.
CONCLUSIONS
8.1
8.1.1
General
The Relume is designed to be operated with split systems so that the worst case failure is loss of one bow thruster and one propulsion thruster. This leaves the vessel with two thrusters operational, one bow and one propulsion thruster. During DP 2 operations the vessel will operate with the bus-ties open.
8.1.2
CONCLUSIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 62
9.
RECOMMENDATIONS
9.1
A Recommendations Essential
None.
9.2
9.2.1
B Recommendations for serious consideration

None.
9.3
9.3.1
C Recommendations- For future consideration / general improvement

None
RECOMMENDATIONS FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 63
10.
TABULATED FAILURE MODES
Power Generation Failure Modes Failure Mode Cause(s) Fuel failure due to Fuel starvation Fuel contamination Catastrophic engine failure Failure of engine (piston, piston rod, cylinder relief v/v, crankcase explosion, governor failure Mechanical failure of shaft between engine and generator Probability Local Effect Final Effect Criticality Remarks Other two engines supplied from separate fuel tanks, will provide adequate power to maintain DP and position.
Low
Engine stoppage
Loss of one pair of engines
Loss of 50% of generation capacity
Minor
Very low
Two engines shut down
Low
Mechanical Failure
Increased load on Loss of power from remaining Minor one engine generators, vessel maintains position
Low
Minimised by good maintenance & procedures. Catastrophic engine failure could cause loss of whole engine room
TABULATED FAILURE MODES FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS
| 30
Power Generation Failure Modes Failure Mode Cause(s) Probability Local Effect Final Effect Possible failure of other engine on the same switchboard on reverse power Running generator take additional load Possible loss of Minor other engine if it is unable to take sudden load Criticality Remarks Alternate engine room will provide adequate power to maintain DP and allow the vessel reach a safe situation.
Generator failure (windings, stators etc.)
Low
Loss of power from one engine
Minor
Electrical Failure
Generator failure (AVR) Loss of power to fuel injection system
Low Low
Defective generator will be tripped Engine shuts down
Alternate engine room will provide adequate power to maintain DP and allow the vessel reach a safe situation. (see also power management)
| 31
Power Generation Failure Modes Failure Mode Cause(s) Pump failure Air in the system Inadequate flow of sea water Poor maintenance Leakage Blocked intake Pump Failure Faulty control valve Inadequate cooling Leakage from cooler Low Air in system Failure of flexible coupling Compressor failure Loss of start air Leakage Low Low Loss of engine start capability None Partial loss of engine start capability Minor Standby compressor available Split system High diesel generator temperature Minor if problem isolated Early warning possible Temperature rise is not sudden Medium Low pressure alarm start standby None Minor Relies on stand-by starting Low High FW temperature Loss of one central Minor cooler Remaining central cooler has 100% capacity for all engines Remaining cooler takes suction from the other side of the vessel Probability Local Effect Final Effect Criticality Remarks
Engine S/D
Minor
| 32
Power Generation Failure Modes Failure Mode Cause(s) Compressor failure Loss of service air Drier failure Probability Low Low Local Effect Reduction in air pressure Moisture in system Final Effect Loss of air to header tank Erratic operation of pneumatics Criticality Minor Minor Remarks Back-up supply available from main starting air system via reducer
| 33
Diesel Generator Failure Modes Failure Mode Cause(s) Probability Local Effect Final Effect Criticality Remarks
Reverse power trip
Other engine Minor Split switchboard Engines running on low load
Excessive vibration Mechanical damage
Low
Generator S/D
Low FO pressure
Low LO pressure
Overspeed Control Fault Instability Low Generator S/D
Second generator s/d on reverse power Minor Operator may shut down healthy machine in error Power loss Low Low Low Tripping of breaker Defective breaker Low Loss of one engine Minor Loss of voltage control on generator
Other engine Split switchboard Engines running on low load
PMS Failure Voltage loss Faulty bus tie status to PMS Wire break
Generator S/D
Minor
Other engine Split switchboard Engines running on low load
| 34
Diesel Generator Failure Modes Failure Mode Cause(s) Mechanical fault Drive motor trip Electrical fault Loss of cooling Electrical fault Converter fault Loss of cooling Speed control fault Wire break Mechanical Electrical Mechanical Electric motor fail Electrical Azimuth feedback failure Unwanted power chop Power chop too late Software fault Low Wire break Wire break Hardware fault Low Low Low Low Excessive thrust Loss of control Reduction in thrust Low Low Low Low Loss of thruster Overspeed Low Generator S/D Reduced DP capability Other thrusters Minor Low load Minor Small position excursion if stopped Low Loss of thruster Reduced DP capability Other thrusters Minor Low load Probability Local Effect Final Effect Criticality Remarks
Unwanted thrust
Lube oil pump failure
Auto start of standby pump
Alarm
Minor Other thrusters Minor Low load Minor Minor Alarm & operator to decide shut down Other thrusters available Split switchboard Major Thrusters on 50%
Reduced DP capability Thrust in an unwanted direction Reduced DP capability Blackout of one 690V board
| 35
Network Failure Modes Failure Mode Cause(s) Probability Local Effect Final Effect Criticality Remarks
One PMS fail
Power loss or overvoltage
Low
Generator S/D
Possible reverse Minor power trip of other engine
Split switchboard
One PMS link fail Wire break Both PMS link fail Wire break Failure of U42 analogue board Internal short circuit
Low Low Low
None DG operate Alarm Minor independently Loss of board and Loss of T1 and T3 Major feedback
Engines running
Vessel remains on DP Position loss possible depending on weather conditions
Failure of U51 analogue board
Internal short circuit
Low
Loss of T2 & T4
Major
Vessel remains on DP Position loss possible depending on weather conditions Split switchboard Others only
Loss of DPU 3 or DPU 4 Loss of DPU 1 or DPU 2
Internal short circuit Internal short circuit
Low Low
Loss of one DG Loss of info on 2 DG
Loss of one engine Minor No effect Minor
| 36
Network Failure Modes Failure Mode Cause(s) Probability Local Effect Loss of info on bow thrusters Final Effect Thrusters continue to operate Criticality Remarks
Loss of DPU 5
Internal short circuit
Minor
| 37
DP Control System Failure Modes Failure Mode Cause(s) Probability Local Effect Final Effect Criticality Remarks
Loss of UPS 1
Failure of unit
Low
Loss of output
Loss of: DPC 21 A(PU1) SPP OS1 Fan Beam
Minor
Other DPC 21 B takes control
Loss of UPS 2
Failure of unit
Low
Loss of output
Loss of: DPC 21 B (PU 2) SDP OS2 HIPAP
Minor
Loss of HPR
Input failure Power failure
Medium Low Medium Low
Prediction error, HPR deselects Prediction error, wind sensor manually deselected DGPS rejected if other position references
Other HPR(s) functioning Other wind sensor(s) functioning Loss or degradation of position if only DGPS on line
Minor
Loss of wind sensor
Input failure Power failure
Minor
Inadequate Poor geometry and Medium satellite coverage shielding from platform
Minor (Major if only Relies on good DGPS procedures used)
| 38
DP Control System Failure Modes Failure Mode Cause(s) Probability Local Effect Final Effect Criticality Remarks
Power failure DGPS 1 failure Correction signal failure Masking Configuration Power failure Correction signal failure DGPS 2 failure Masking Configuration Loss of vertical reference Loss of target / false target Loss of serial link to DP Loss of 24V Taut Wire failure Potentiometer meter fault Low (see others in report)
Medium
No/failed input to Other reference DP, DGPS systems available rejected
Minor
Medium
No/failed input to Other reference DP, DGPS systems available rejected
Minor
Fan Beam Failure
Medium
Sensor out of range
Sensor deselected Minor
At least two other sensor types should be in use
No data or wrong Rejection by DP data in one axis control
Minor
Major if not detected or wrong weight
| 39
APPENDICES
TYPE APPENDIX NAME
TYPE APPENDIX DESCRIPTION
TYPE APPENDIX NAME - TYPE APPENDIX DESCRIPTION FMEA OF OSV "RELUME" GLOBAL MARITIME | 24025-0912-16117 | REVISION 9 ISSUED FOR MENAS

Relume FMEA

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Relume FMEA

Uploaded by

Copyright:

Available Formats

FMEA OF OSV "RELUME"

SUMMARY ............................................................. 1 INTRODUCTION .................................................... 2

REDUNDANCY CONCEPT OVERVIEW ................ 6 POWER GENERATION ......................................... 8

Registered in London No. 2912969

4.29 4.30 4.31

DP CONTROL SYSTEMS .................................... 49

Registered in London No. 2912969

9.1 9.2 9.3

TABULATED FAILURE MODES ......................... 30

Figures & Tables

Registered in London No. 2912969

Registered in London No. 2912969

Figure 2-1: OSV Relume Profile

I.M.O 645 Section 3.2.3:

REDUNDANCY CONCEPT OVERVIEW

Fuel Oil System

Daily Service Tank 1

Daily Service Tank 2

Fuel Settling Tank 1

Fuel Settling Tank 2

$e!ote o"erate% & C 'alve FO Booster P Ps

Figure 4-1: Fuel Oil System (Ref drawing No 320.01)

FO System Failure Modes

Failure Mode F.O. Starvation (two DGs) F.O. Contamination

Effects Unable to deliver demanded power Unable to deliver demanded power

Mitigation Other thruster compensates Other thruster compensates

Table 4-1: FO System Failure Modes

Sea Water Cooling

Figure 4-2: SW Cooling System (Ref drawing 330.01)

SW Cooling System Failure Modes

Can use other suction

Table 4-2: SW System Failure Modes

Fresh Water Cooling System

Figure 4-3: Fresh Water Cooling System

FW Cooling System Failure Modes

Failure Mode Inadequate Cooling

Effects Alarms High D.G Temperatures Risk of blackout

Table 4-3: FW Cooling System Failure Modes

Figure 4-4: Engine LO System Schematics

LO Cooling System Failure Modes

Figure 4-5: Compressed Air System Layout

Compressed Air System Failure Modes

Ventilation failure Modes

Diesel Generator Engines

Table 4-4: Main Engine WECS Power Supplies

Diesel Generator Engines Failure Modes

Other engines Other engines

Table 4-5: Main Engines Failure Modes

unstable and trip.

Power Management System

DPU4 DPU5 (XS316 XS317) DPU5 XS318 DPU7 DPU8

LOCATION Engine Room PS Tween Deck Fr 71

PRAXIS UPS cct F11

Engine Room SB Tween Deck Fr 71

PRAXIS UPS cct F12

Carpenters Workshop Hold PS Tween Deck Fr 62

PRAXIS UPS cct F13

Table 4-6: Alarm & Control System I/O Units

Table 4-7: Alarm & Control System Network Configuration

Table 4-8: Alarm & Control System Failure Modes

Figure 4-6: PMS Layout

Engine Room Fire

690V Main Switchboard

690V Main Switchboard Failure Modes